6466 matches found
CVE-2022-32565
An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and document ids...
CVE-2022-33175
Power Distribution Units running on Powertek firmware multiple brands before 3.30.30 have an insecure permissions setting on the user.token field that is accessible to everyone through the /cgi/getparam.cgi HTTP API. This leads to disclosing active session ids of currently logged-in administrator...
CVE-2022-33175
Power Distribution Units running on Powertek firmware multiple brands before 3.30.30 have an insecure permissions setting on the user.token field that is accessible to everyone through the /cgi/getparam.cgi HTTP API. This leads to disclosing active session ids of currently logged-in administrator...
CVE-2022-32565: Insertion of Sensitive Information into Log File
An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and document ids...
PT-2022-21377
Name of the Vulnerable Software and Affected Versions Couchbase Server versions prior to 7.0.4 Description An issue was discovered in the Backup Service log, which leaks unredacted usernames and document ids. Recommendations For versions prior to 7.0.4, update to version 7.0.4 or later to resolve...
PYSEC-2022-206
OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log in to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub only to users of a given institute. The allowedidps...
Denial Of Service (DoS)
pocketmine/pocketmine-mp is vulnerable to denial of service. The vulnerability exists in the netItemStackToCore function in TypeConverter.php due to a lack of validation in item ids which allows an attacker to cause an application crash...
GHSA-FQX3-R75H-VC89 Improperly checked IDs on itemstacks received from the client leading to server crash in PocketMine-MP
Impact Due to a workaround for unmapped network items implemented in 4.0.0-BETA5 8ac16345a3bc099b62c1f5cfbf3b736e621c3f76, arbitrary item IDs are able to be written into an item's NBT. The intended purpose of this is to make said unmapped network items able to be moved around the inventory withou...
CVE-2022-31279
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
PT-2022-28242
Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to the version containing the patch 5fd685e07d61ef670584ed11a52fd5f4b99a81a7 Description The issue arises from a workaround implemented for unmapped network items, allowing arbitrary item IDs to be written into an...
Security Bulletin: NVIDIA DGX A100 Firmware - June 2022
NVIDIA has released a security update for NVIDIA DGX A100 firmware. This update addresses issues that may lead to information disclosure, denial of service, or escalation of privileges. To protect your system, download and install this firmware update through the NVIDIA Enterprise Support Portal...
Logical and Creative SQL Injection Vulnerabilities
Lógico y Creativo is an e-commerce service from Lógico y Creativo Argentina. version 1.0 of Lógico y Creativo is vulnerable to SQL injection, which can be exploited by attackers to manipulate parameter ids to cause sql injection problems...
PT-2022-14048
Name of the Vulnerable Software and Affected Versions The Note Press WordPress plugin versions 0.1.10 and earlier Description The issue is related to an SQL injection problem. The Note Press WordPress plugin does not properly sanitise and escape the ids from the bulk actions before using them in ...
Design/Logic Flaw
BigBlueButton is an open source web conferencing system. In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can circumvent access controls to gain access to all breakout rooms of the meeting they are in. The permission checks rely on knowledge of internal ids rather th...
PT-2022-4944 · Unknown · Rocket.Chat
Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions prior to 5 Rocket.Chat versions prior to 4.8.2 Rocket.Chat versions prior to 4.7.5 Description: An information disclosure issue exists due to the getReadReceipts Meteor server method not properly filtering user inputs...
Jenkins Artifactory Plugin missing permission check
Jenkins Artifactory Plugin provides a list of applicable credential IDs to allow users configuring the plugin to select the one to use. This functionality does not correctly check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those can be used...
Missing permission checks in Jenkins Config File Provider Plugin allow enumerating configuration file IDs
Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate configuration file IDs. An enumeration of configuration file IDs in Jenkins Config File Provider Plugin 3.7.1 require...
Incorrect permission checks in Jenkins Config File Provider Plugin allow enumerating credentials IDs
Jenkins Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints. This allows attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins. Those can be used as part of an...
Missing permission check in Jenkins Team Foundation Server Plugin allows enumerating credentials IDs
Jenkins Team Foundation Server Plugin 5.157.1 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials...
Missing permission check in Jenkins Cloud Statistics Plugin
Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission and knowledge of random activity IDs to view related provisioning exception error messages. Jenkins Cloud Statistics Plugin 0.27 requires...