The Uniquely American Future of US Authoritarianism

The GOP-fueled far right differs from similar movements around the globe, thanks to the country’s politics, electoral system, and changing demographics...

CVE-2023-25594

A vulnerability in the web-based management interface of ClearPass Policy Manager allows an attacker with read-only privileges to perform actions that change the state of the ClearPass Policy Manager instance. Successful exploitation of this vulnerability allows an attacker to...

Design/Logic Flaw

A vulnerability in the web-based management interface of ClearPass Policy Manager allows an attacker with read-only privileges to perform actions that change the state of the ClearPass Policy Manager instance. Successful exploitation of this vulnerability allows an attacker to complete...

CVE-2023-25594: Incorrect Authorization

A vulnerability in the web-based management interface of ClearPass Policy Manager allows an attacker with read-only privileges to perform actions that change the state of the ClearPass Policy Manager instance. Successful exploitation of this vulnerability allows an attacker to...

SUSE CVE-2022-35229

An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict...

PT-2023-13408 · Dell · Powerpath Management Appliance

Name of the Vulnerable Software and Affected Versions: PowerPath Management Appliance versions 3.0 through 3.3 Description: The issue allows an unauthenticated non-privileged user to potentially exploit the Cross-site Request Forgery vulnerability and perform any privileged state-changing actions...

CVE-2022-34448: Cross-Site Request Forgery (CSRF)

PowerPath Management Appliance with versions 3.3 & 3.2, 3.1 & 3.0 contains a Cross-site Request Forgery vulnerability. An unauthenticated non-privileged user could potentially exploit the issue and perform any privileged state-changing actions...

[M-04] Balance manipulation when contract is paused

Lines of code Vulnerability details Impact State-changing methods missing the whenNotPaused modifier, is a security hole. Even when contract is paused increaseTotalBalance and decreaseTotalBalance methods can be called internally. Therefore, medium severity matches. Proof of Concept function...

CVE-2023-23078

Cross site scripting XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the Assets...

PT-2023-18836

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 14 Description The issue is related to a cross site scripting XSS vulnerability. It occurs via the comment field when changing the credentials in the Assets. Recommendations For Zoho ManageEngine...

PT-2025-38344

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a memory leak within the tcindex set parms function, specifically when changing existing filter properties. The issue arises when an old filter result is cleare...

1-phase governor changing in Fed

Lines of code Vulnerability details Impact Mistake in calling this function setting 0-address or just wrong address will lead to full control loosing Tools Used vs code Recommended Mitigation Steps Do 2-phase changing like in DolaBorrowingRights.setPendingOperator and...

CVE-2022-39056 Changing Information Technology Inc. RAVA certificate validation system - SQL Injection

RAVA certificate validation system has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify and delete database...

Changing Information Technology RAVA certificate validation system SQL注入漏洞

Changing Information Technology RAVA certificate validation system Panorama Software RAVA certificate validation system website is a credential validation system from China-based Changing Information Technology. The Panorama Software RAVA certificate validation system suffers from a SQL injection...

Changing Information Technology RAVA certificate validation system 安全漏洞

Changing Information Technology RAVA certificate validation system Panorama Software RAVA certificate validation system website is a certificate validation system from China-based Changing Information Technology. A security vulnerability exists in the Changing Information Technology RAVA...

Changing Information Technology RAVA certificate validation system 路径遍历漏洞

Changing Information Technology RAVA certificate validation system Panorama Software RAVA certificate validation system website is a credential validation system from the Chinese company Changing Information Technology. A path traversal vulnerability exists in the Changing Information Technology...

CVE-2020-8973

ZGR TPS200 NG in its 2.00 firmware version and 1.01 hardware version, does not properly accept specially constructed requests. This allows an attacker with access to the network where the affected asset is located, to operate and change several parameters without having to be registered as a user...

DEBIAN-CVE-2022-42906

powerline-gitstatus aka Powerline Gitstatus before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs gi...

WordPress Quiz And Survey Master plugin <= 7.3.4 - Insecure direct object references (IDOR) vulnerability

Insecure direct object references IDOR vulnerability leading to Changing of Quiz Content discovered by Ngo Van Thien Patchstack Alliance in WordPress Quiz And Survey Master plugin versions = 7.3.4. Solution Update the WordPress Quiz And Survey Master plugin to the latest available version at leas...

GSD-2022-1005377 KVM: x86/xen: Stop Xen timer before changing IRQ

KVM: x86/xen: Stop Xen timer before changing IRQ This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.2 by commit...