106 matches found
CVE-2023-3462
HashiCorp Vault and Vault Enterprise are vulnerable to user enumeration through the LDAP auth method. An attacker can distinguish existing vs non-existent LDAP users by response discrepancies. Impact is information disclosure with no exploit details provided. Fixed in Vault 1.14.1 and 1.13.5; rem...
CVE-2023-3462 Vault's LDAP Auth Method Allows for User Enumeration
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed i...
1851-unfilmed.org.uk Cross Site Scripting vulnerability OBB-3478506
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Debian: Security Advisory (DLA-3462-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2023-3462
creationtimestamp| type| source ---|---|--- 2023-06-08 23:06:38+00:00| published-proof-of-concept| https://t.me/ctinow/116997 2023-06-08 23:11:48+00:00| seen| https://t.me/ctinow/116999...
RHEL 8 : kernel-rt (RHSA-2023:3462)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3462 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Securi...
K22356857: APT remote code injection vulnerability CVE-2019-3462
Security Advisory Description Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine. CVE-2019-3462 Impact There is no impact; F5...
CVE-2022-3462 Highlight Focus <= 1.1 - Admin+ Stored Cross Site Scripting
The Highlight Focus WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2022-3462
CVE-2022-3462 affects the Highlight Focus WordPress plugin (versions ≤ 1.1). The issue arises from insufficient sanitization/escape of plugin settings, enabling high-privilege users (e.g., admins) to perform Stored XSS even when unfiltered_html is disallowed (multisite scenarios). Exploitation de...
openSUSE: Security Advisory for slurm_18_08 (SUSE-SU-2022:3462-1)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
CVE-2019-3462
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine...
CVE-2021-3462
A privilege escalation vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could allow unauthorized access to the driver's device object...
CVE-2021-3462
CVE-2021-3462 (Lenovo Power Management Driver, Windows 10) : A privilege escalation flaw in the Lenovo Power Management Driver prior to version 1.67.17.54 allows unauthorized access to the driver’s device object. The issue is local and does not require user interaction beyond being on the affecte...
Lenovo Power Management Driver Vulnerabilities - Lenovo Support US
No description provided...
Cisco Data Center Network Manager SQL Injection (cisco-sa-dcnm-sql-inject-8hk6PwmF)
According to its self-reported version, Cisco Data Center Network Manager is affected by a SQL injection vulnerability due to improper validation of user-supplied input. An attacker could exploit this vulnerability by authenticating to the application and sending malicious requests to an affected...
Command injection
In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service. In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host via ipv6.disable=1 ...
theemcoe.org Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1135400 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
DEBIAN-CVE-2012-3462
A flaw was found in SSSD version 1.9.0. The SSSD's access-provider logic causes the result of the HBAC rule processing to be ignored in the event that the access-provider is also handling the setup of the user's SELinux user context...
CVE-2012-3462
SSSD 1.9.0 contains a logic flaw in its access-provider path where HBAC rule results are ignored if the access-provider also sets the user’s SELinux context. Affected component: SSSD HBAC/access-provider integration. Impact described: incorrect HBAC evaluation under scenarios where SELinux user c...
CVE-2019-3462
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine...