17590 matches found
Design/Logic Flaw
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.6.4, macOS Sonoma 14.2. An app may be able to read arbitrary files...
Design/Logic Flaw
The issue was addressed with additional permissions checks. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, iOS 17.3 and iPadOS 17.3. A shortcut may be able to use sensitive data with certain actions without prompting the user...
PT-2024-19063 · Unknown · Electronic Deliverables Creation Support Tool
Name of the Vulnerable Software and Affected Versions: Electronic Deliverables Creation Support Tool Construction Edition versions prior to 1.0.4 Electronic Deliverables Creation Support Tool Design & Survey Edition versions prior to 1.0.4 Description: The issue is related to the improper...
JVN#40049211: Improper restriction of XML external entity references (XXE) in Electronic Deliverables Creation Support Tool provided by Ministry of Defense
Electronic Deliverables Creation Support Tool provided by Ministry of Defense improperly restricts XML external entity references XXE CWE-611. Impact Processing a specially crafted XML file may lead to exposure of internal files on the system. Solution Update the Software Update the software to t...
Ministry of Defense Electronic Deliverables Creation Support Tool Security Breach
Ministry of Defense Electronic Deliverables Creation Support Tool is an electronic deliverables creation support tool from Ministry of Defense, Japan. A security vulnerability exists in Ministry of Defense Electronic Deliverables Creation Support Tool Construction Edition version 1.0.4, Electroni...
Design/Logic Flaw
A use-after-free flaw was found in the ext4remount in fs/ext4/super.c in ext4 in the Linux kernel. This flaw allows a local user to cause an information leak problem while freeing the old quota file names before a potential failure, leading to a use-after-free...
Design/Logic Flaw
chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted...
Design/Logic Flaw
MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.runscript passes shell metacharacters to subprocess.Popen...
Design/Logic Flaw
GenerateSDFPipeline in syntheticdataframe in PandasAI aka pandas-ai through 1.5.17 allows attackers to trigger the generation of arbitrary Python code that is executed by SDFCodeExecutor. An attacker can create a dataframe that provides an English language specification of this Python code. NOTE:...
WordPress Photo Gallery by 10Web Plugin <= 1.8.19 is vulnerable to Directory Traversal
Software Photo Gallery by 10Web Type Plugin Vulnerable versions = 1.8.19 Fixed in 1.8.20 OWASP Top 10 A4: Insecure Design Classification Directory Traversal CVE CVE-2024-0221 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID 29011d5256be Credits Bence Szalai Required privile...
Design/Logic Flaw
The OpenAPI and ChatGPT plugin loaders in LlamaHub aka llama-hub before 0.0.67 allow attackers to execute arbitrary code because safeload is not used for YAML...
Design/Logic Flaw
The JSON loader in Embedchain before 0.1.57 allows a ReDoS regular expression denial of service via a long string to json.py...
Design/Logic Flaw
An issue in yonyou YonBIP v323.05 allows a remote attacker to execute arbitrary code via a crafted script to the ServiceDispatcherServlet uap.framework.rc.itf.IResourceManager component...
Design/Logic Flaw
An issue in weaver e-cology v.10.0.2310.01 allows a remote attacker to execute arbitrary code via a crafted script to the FrameworkShellController component...
Design/Logic Flaw
Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation CBOR versions 4.0.0 to 4.5.1 allows an attacker to cause a denial of service by passing a maliciously crafted input. Depending on an application's use...
Design/Logic Flaw
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-36263. Reason: This record is a duplicate of CVE-2023-36263. Notes: All CVE users should reference CVE-2023-36263 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage...
Design/Logic Flaw
An issue in dom96 HTTPbeast v.0.4.1 and before allows a remote attacker to execute arbitrary code via a crafted request to the parser.nim component...