7066 matches found
CVE-2021-24282
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the plugin to do a variety of things. For example, an attacker could use wpcf7rresetsettings to reset the plugin’s settings, wpcf7raddaction to...
CVE-2020-28015
Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. Local users can alter the behavior of root processes because a recipient address can have a newline character. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...
CVE-2021-29242
CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressing scheme and may re-route, add, remove or change low level communication packages...
CVE-2021-29435
trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially...
PT-2021-18211
Name of the Vulnerable Software and Affected Versions: trestle-auth versions 0.4.0 through 0.4.1 Description: A vulnerability in trestle-auth allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This...
CVE-2021-29435: Cross-Site Request Forgery (CSRF)
trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially...
CVE-2021-27900
The Proofpoint Insider Threat Management Server formerly ObserveIT Server is missing an authorization check on several pages in the Web Console. This enables a view-only user to change any configuration setting and delete any registered agents. All versions before 7.11.1 are affected...
Input validation
The Proofpoint Insider Threat Management Agents formerly ObserveIT Agent for MacOS and Linux perform improper validation of the ITM Server's certificate, which enables a remote attacker to intercept and alter these communications using a man-in-the-middle attack. All versions before 7.11.1 are...
CVE-2020-9978
This issue was addressed with improved setting propagation. This issue is fixed in macOS Big Sur 11.0.1, tvOS 14.0, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, watchOS 7.0, iOS 14.0 and iPadOS 14.0. An attacker in a privileged network position may be ab...
Design/Logic Flaw
This issue was addressed with improved setting propagation. This issue is fixed in macOS Big Sur 11.0.1, tvOS 14.0, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, watchOS 7.0, iOS 14.0 and iPadOS 14.0. An attacker in a privileged network position may be ab...
PT-2021-14085
Name of the Vulnerable Software and Affected Versions: Cybozu Office versions 10.0.0 through 10.8.4 Description: The issue is related to improper access control in the Scheduler component, allowing an authenticated attacker to bypass access restrictions and alter Scheduler data via unspecified...
PT-2021-14087
Name of the Vulnerable Software and Affected Versions: Cybozu Office versions 10.0.0 through 10.8.4 Description: The issue is related to an improper access control vulnerability in the Workflow of Cybozu Office, allowing authenticated attackers to bypass access restrictions and alter Workflow dat...
PT-2021-14086
Name of the Vulnerable Software and Affected Versions: Cybozu Office versions 10.0.0 through 10.8.4 Description: The issue is related to improper access control in the Bulletin Board component, allowing an authenticated attacker to bypass access restrictions and alter data via unspecified vectors...
CVE-2020-4863
IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190566...
CVE-2021-20662
Missing authentication for critical function in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to alter the setting information without the access privileges via unspecified vectors...
CVE-2021-20662: Missing Authentication for Critical Function
Missing authentication for critical function in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to alter the setting information without the access privileges via unspecified vectors...
PT-2021-14122
Name of the Vulnerable Software and Affected Versions: SolarView Compact SV-CPT-MC310 versions prior to Ver.6.5 Description: The issue is related to missing authentication for a critical function, allowing an attacker to alter setting information without access privileges via unspecified vectors...
PT-2021-14111
Name of the Vulnerable Software and Affected Versions: ELECOM NCC-EWF100RMWH2 affected versions not specified Description: A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators and execute an arbitrary request via an unspecified vector. Thi...
ESET NOD32 Antivirus Access Control Error Vulnerability
ESET NOD32 Antivirus is a suite of antivirus software from ESET Slovakia. An Access Control Error vulnerability exists in ESET NOD32 Antivirus, which can be exploited by an attacker to bypass ESET NOD32 Antivirus access restrictions in order to alter data...
postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks
A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption...