85 matches found
CVE-2025-43865
React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values of the data object passed to the HTML. This issue has bee...
CVE-2025-43865: Insufficient Verification of Data Authenticity
React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values of the data object passed to the HTML. This issue has bee...
React Router allows pre-render data spoofing on React-Router framework mode
Summary After some research, it turns out that it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values of the data object passed to the HTML. Latest versions are impacted. Details The vulnerable header i...
CVE-2023-34403
The Mercedes-Benz head-unit NTG6 (MBUX multimedia system) is vulnerable to a race condition in the UserData service due to synchronization errors when using a shared resource ("Race Mode" ). An attacker with physical access can exploit this by connecting to Ethernet pins on the Base Board to gain...
CVE-2024-3279: Missing Authentication for Critical Function
An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allows an anonymous attacker, without an account in the application, to import their own database file, leading to the deletion or spoofing of...
CVE-2023-45586
An insufficient verification of data authenticity vulnerability CWE-345 in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.12 & FortiProxy SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.13...
SUSE CVE-2023-49345
Temporary data passed between application components by Budgie Extras Takeabreak applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false...
ROS-20230127-01
A vulnerability in the Mozilla Thunderbird email client is related to the fact that the browser's full-screen notification could have been delayed or suppressed, which could lead to data spoofing. Exploitation of the vulnerability could allow an attacker acting remotely to direct a user to a...
ROS-20230124-04
The vulnerability in the Mozilla Firefox browser is due to the fact that a deprecated library libusrsctp contained a vulnerability that could potentially be exploited. vulnerabilities that could potentially be exploited. Exploitation of the vulnerability could allow an attacker acting remotely to...
Vulnerabilities fixed in Apple Safari
Apple has fixed vulnerabilities in Safari. A unauthenticated remote malicious person could exploit the vulnerabilities potentially exploit them to execute arbitrary code under application privileges, gain access to sensitive data or spoofing Safari's user interface. For successful abuse, the...
NFT owner can change tokenURI
Lines of code Vulnerability details Impact In the ERC721OnChain implementation the token owner can set the token's URI using setTokenURI. Usually, this is token URI points to data defining the NFT attributes, images, etc.. It's usually set by the contract owner. A user that owns an NFT can just...
bubble fireworks 数据伪造问题漏洞
bubble is an application. It is a Bubble Tea TUI component. A security vulnerability exists in previous versions of bubble fireworks 2021.BUILD-SNAPSHOT, which stems from the fxbin/bubble-fireworks package not properly verifying the signature of JSON web tokens, which can be exploited by an...
CVE-2019-14396
API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data SEC-495...
Code injection
API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data SEC-495...
CVE-2019-5215
There is a man-in-the-middle MITM vulnerability on Huawei P30 smartphones versions before ELE-AL00 9.1.0.162C01E160R1P12/C01E160R2P1, and P30 Pro versions before VOG-AL00 9.1.0.162 C01E160R1P12/C01E160R2P1. When users establish connection and transfer data through Huawei Share, an attacker could...
Design/Logic Flaw
OleumTech Wireless Sensor Network devices allow remote attackers to obtain sensitive information about sensor nodes or spoof devices by reading cleartext protocol data...
CVE-2017-9045
The Google I/O 2017 application before 5.1.4 for Android downloads multiple .json files from http://storage.googleapis.com without SSL, which makes it easier for man-in-the-middle attackers to spoof Feed and Schedule data by creating a modified blocksv4.json file...
CVE-2017-9045
The CVE-2017-9045 issue affects the Google I/O 2017 Android app (pre-5.1.4). It downloads multiple .json files from http://storage.googleapis.com without SSL, enabling MITM attackers to spoof Feed and Schedule data via a modified blocks_v4.json file. This is described in official CVE/NVD records;...