Nix Security Vulnerabilities

Nix is a powerful package manager from Nix open source. It is used for making packages. A security vulnerability exists in Nix 2.20.3 and earlier versions, which stems from the fact that a fixed-output derivation on Linux can send a file descriptor from Nix storage to another program running on t...

MTN Group: Insecure direct Object Reference(Horizontal Escalation)

The vulnerability allowed for insecure direct object reference horizontal escalation. Specifically, the user's dashboard was accessed without authentication, and the text content was modified through client-side inspection and manipulation...

GHSA-6PGR-J9V4-XFVV ThingsBoard Server-Side Template Injection

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...

Rockstar Games: Exposed CDN access token allows modification of all newly uploaded Snapmatic photos

A CDN access token was exposed that allowed modification of newly uploaded Snapmatic photos in GTA5. This provided a brief window to alter content after uploading. The issue was fixed by removing the exposed CDN fields...

CVE-2023-30949

A missing origin validation in Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishing attacks...

Input validation

A missing origin validation in Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishing attacks...

CVE-2023-30949 CVE-2023-30949

A missing origin validation in Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishing attacks...

Slate 访问控制错误漏洞

slate is an extensible WYSIWYG web application from slate for quickly creating interactive, data-driven web pages. A security vulnerability exists in Slate versions prior to 6.207.0, which stems from a lack of source validation in the sandbox that could be exploited by a malicious user to modify...

PT-2023-23079 · Slate · Slate

Name of the Vulnerable Software and Affected Versions: Slate affected versions not specified Description: A missing origin validation in the Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishing attacks. Recommendations: At the moment, the...

The vulnerability of the monitoring system for critical equipment, StruxureWare Data Center Expert, arises from the lack of measures taken to protect the SQL query structure. This allows attackers to modify or delete any content they desire.

The vulnerability of the StruxureWare Data Center Expert monitoring system relates to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to modify or delete any content at will...

PT-2023-3494 · Schneider Electric · Struxureware Data Center Expert

Name of the Vulnerable Software and Affected Versions: StruxureWare Data Center Expert affected versions not specified Description: A SQL Injection vulnerability exists due to improper neutralization of special elements in SQL commands, allowing an authenticated user to access, change, or delete...

Mars: Html injection

The consultant identified that the show parameter can reflect into the HTML page. An attacker could have crafted a malicious query that resulted in the inclusion of attacker-controlled HTML elements on the web page, changing the content presented to users. The vulnerability was assessed to have a...

CVE-2023-2783

Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the contents of the post sent by the Apps...

Apache StreamPark LDAP Injection vulnerability

Apache StreamPark versions 1.0.0 to 2.0.0 have an LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements...

CVE-2022-45801

Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements through...

Sql injection

Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements through...

CVE-2022-45801 Apache StreamPark (incubating): LDAP Injection Vulnerability

Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements through...

Cross site scripting

XWiki Commons are technical libraries common to several other top level XWiki projects. The RSS macro that is bundled in XWiki included the content of the feed items without any cleaning in the HTML output when the parameter content was set to true. This allowed arbitrary HTML and in particular...

CVE-2023-29202 org.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerability

XWiki Commons are technical libraries common to several other top level XWiki projects. The RSS macro that is bundled in XWiki included the content of the feed items without any cleaning in the HTML output when the parameter content was set to true. This allowed arbitrary HTML and in particular...

The vulnerability of the monitoring system for critical equipment, StruxureWare Data Center Expert, is related to deficiencies in authentication procedures. This allows unauthorized users to perform unauthorized functions, modify or delete arbitrary content.

The vulnerability of the StruxureWare Data Center Expert monitoring system is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to perform unauthorized functions, modify or delete arbitrary content...