Fail to enumerate resource with "Cannot complete your request "error after configure SAML

Fail to enumerate resource with "Cannot complete your request "error after configure SAML All users have the same issue Issue happen after click "detect Workspace" on Storefront web...

-pattern parameter in the rewrite action was removed in 13.1

When user configure rewrite action with pattern param in GUI or CLI in NS 13.1, below error may prompt:"ERRO: No such argument -pattern" e.g add rewrite action rwainsertintracaptchaag insertbeforeall "HTTP.RES.BODY8000.SETTEXTMODEIGNORECASE" q" " + "" -pattern "" ERROR: No such argument -pattern...

Craft CMS vulnerable to Remote Code Execution via validatePath bypass

Summary Bypassing the validatePath function can lead to potential Remote Code Execution Post-authentication, ALLOWADMINCHANGES=true Details In bootstrap.php, the SystemPaths path is set as below. php // Set the vendor path. By default assume that it's 4 levels up from here $vendorPath =...

CVE-2023-30674

Improper configuration in Samsung Internet prior to version 21.0.0.41 allows attacker to bypass SameSite Cookie...

CVAD 2203 CU2: Error: "Your OneDrive folder can't be created in the location you selected.”

On CVAD 2203 CU2, you followedhttps://docs.citrix.com/en-us/profile-management/current-release/configure/enable-the-onedrive-container.html to configure OneDrive Container with Citrix Profile Management but it does not work. The Policy was applied via Citrix Active Directory GPO...

Input validation

Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server. The configuration option proxy.config.http.pushmethodenabled didn't function. However, by default the PUSH method is blocked in the ipallow configuration file.This issue affects Apache Traffic Server:...

CVE-2023-34258

An issue was discovered in BMC Patrol before 22.1.00. The agent's configuration can be remotely queried. This configuration contains the Patrol account password, encrypted with a default AES key. This account can then be used to achieve remote code execution...

rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations

A Cross-site scripting vulnerability was found in rails-html-sanitizer. Certain configurations of rails-html-sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags...

CVE-2023-29163 BIG-IP UDP Profile vulnerability

When UDP profile with idle timeout set to immediate or the value 0 is configured on a virtual server, undisclosed traffic can cause TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2022-40723

The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations...

PT-2023-20776 · Unknown +1 · Blackbox Exporter +1

Name of the Vulnerable Software and Affected Versions: blackbox exporter version 0.23.0 Description: The issue is related to an access control problem in the probe interface of blackbox exporter, allowing attackers to detect intranet ports and services, as well as download resources. It is noted...

PT-2023-17310 · Thorsten · Phpmyfaq

Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue is related to Cross-site Scripting XSS - DOM, where the software fails to sanitize user input in the configuration privacy note URL parameter. This allows for potential...

StoreFront - Unable to import configuration

Unable to import StoreFront configuration from existing environment into a newly installed Storefront server with no stores created...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS, which stems from a configuration issue in some cell phone products. An attacker could exploit the...

SUSE CVE-2021-33197

In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy from net/http/httputil result in a situation where an attacker is able to drop arbitrary headers...

MGASA-2023-0049 Updated phpmyadmin packages fix security vulnerability

Security fix for an XSS vulnerability in the drag-and-drop upload functionality PMASA-2023-01 Additional bugfixes including - issue 17506 Fix error when configuring 2FA without XMLWriter or Imagick issue 17519 Fix Export pages not working in certain conditions issue 17121 Fix passwordhash functio...

CVE-2023-24350

D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the config.smtpemailsubject parameter at /goform/formSetEmail...

PT-2023-33753 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.16 Description: The issue is related to a missing unlock in irq configuration in the uio dmem genirq component. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

CVE-2023-22466 Tokio's reject_remote_clients configuration may get dropped when creating a Windows named pipe

Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows named pipe server, setting pipemode will reset rejectremoteclients to false. If the application has previously configured...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from a security vulnerability that stems from a configuration issue in some cell phone products. An attacker exploited the...