PT-2023-31929

Name of the Vulnerable Software and Affected Versions tj-actions/verify-changed-files versions prior to 17 Description The tj-actions/verify-changed-files action allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. The...

CVE-2023-52137: Improper Input Validation

The tj-actions/verify-changed-files action allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. The verify-changed-files workflow returns the list of files changed within a workflow execution. This could potentially allow...

verify-changed-files Input Verification Error Vulnerability

changed-files is used to track the relative paths returned from the project root for all changed files and directories associated with the target branch, previous commits, or the last remote commit. An input validation error vulnerability exists in versions prior to verify-changed-files 17.0.0,...

hospitalcima.es Improper Access Control vulnerability OBB-3822267

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Denial Of Service (DoS)

@octokit/webhooks is vulnerable to Denial Of Service DoS. The vulnerability is caused by a lack of exception handling in the verifyAndReceive method within src/verify-and-receive.ts. This method internally calls another method verify which throws an exception which remains unhandled. This uncaugh...

Security Bulletin: IBM Security Verify Information Queue has a third-party library vulnerability (CVE-2023-43642)

Summary IBM Security Verify Information Queue ISIQ v10.0.7 has upgraded its Apache Kafka client to remediate a vulnerability in the snappy-java compression library. Vulnerability Details CVEID:CVE-2023-43642 DESCRIPTION: snappy-java is vulnerable to a denial of service, caused by missing upper...

Security Bulletin: IBM Security Verify Access is vulnerable to Rapid Reset attacks if HTTP2 is enabled (CVE-2023-44487)

Summary The Webseal component of IBM Security Verify Access product is vulnerable to CVE-2023-44487, a flaw in handling multiplexed streams in the HTTP/2 protocol. Vulnerability Details CVEID:CVE-2023-44487 DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by a flaw in...

Default configuration

When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct...

CVE-2023-45292

When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct...

CVE-2023-45292: Insufficient Verification of Data Authenticity

When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct...

base64Captcha Security Vulnerability

base64Captcha is a flexible and diverse CAPTCHA package for mojocn individual developers. A security vulnerability exists in base64Captcha that stems from the ability to bypass validation when checking CAPTCHA using Verify's default configuration...

GO-2023-2386 Captcha verification bypass in github.com/mojocn/base64Captcha

When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct...

PT-2023-29488 · Git +3 · Base64Captcha +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue concerns the default implementation of a Verify function used to check a Captcha. Verification can be bypassed under certain conditions. For...

openssl: Certificate policy check not enabled

A flaw was found in OpenSSL. The X509VERIFYPARAMadd0policy function is documented to enable the certificate policy check when doing certificate verification implicitly. However, implementing the function does not enable the check, allowing certificates with invalid or incorrect policies to pass t...

pocsuite3

This is an open-sourced remote vulnerability testing and proof-of-concept development framework developed by the Knownsec 404 Team. It comes with a powerful proof-of-concept engine, many nice features for the ultimate penetration testers and security researchers. The framework supports various...

RHEL 7 / 8 / 9 : Red Hat JBoss Web Server 5.7.7 (RHSA-2023:7622)

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7622 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of...

PT-2023-27263 · Bluetooth · Bluetooth

Name of the Vulnerable Software and Affected Versions: Bluetooth software affected versions not specified Description: The issue is related to a possible way to bypass signature validation due to side channel information disclosure in the BTM BleVerifySignature function of btm ble.cc. This could...

VulnCheck KEV: CVE-2021-33564

An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verifyurl option is disabled. This may lead to code execution. The problem occurs because the generate and process features...

The vulnerability of the software for automated, cloud-based, and on-premise administration of IBM Security Verify Privilege accounts lies in the lack of data encryption measures. This allows attackers to carry out “man-in-the-middle” attacks.

The vulnerability of the software for automated, cloud-based, and on-premise administration of IBM Security Verify Privilege accounts is related to the lack of data encryption measures. Exploiting this vulnerability could allow a malicious actor to carry out “man-in-the-middle” attacks...

CVE-2023-2440

The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing nonce validation in the 'adminpage', 'userproverifyuser' and 'verifyUnverifyAllUsers' functions. This makes it possible for unauthenticated attackers to...