17063 matches found
Design/Logic Flaw
An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function...
Design/Logic Flaw
The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase bookings without payment...
Design/Logic Flaw
An issue in Tneda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the adslPwd parameter in the formfastsettinginternetset function...
Design/Logic Flaw
The Mmm Simple File List WordPress plugin through 2.3 does not validate the generated path to list files from, allowing any authenticated users, such as subscribers, to list the content of arbitrary directories...
Design/Logic Flaw
The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service...
Experts Uncover Passive Method to Extract Private RSA Keys from SSH Connections
A new study has demonstrated that it's possible for passive network attackers to obtain private RSA host keys from a vulnerable SSH server by observing when naturally occurring computational faults that occur while the connection is being established. The Secure Shell SSH protocol is a method for...
Design/Logic Flaw
Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This issue affects Apache Superset: before 2.1.2. Users should upgrade to version or above 2.1.2 and run superset init to reconstruct the Gamma role or remove canre...
Design/Logic Flaw
The Android Mobile Whale browser app before 3.0.1.2 allows the attacker to bypass its browser unlock function via 'Open in Whale' feature...
U.S., U.K., and Global Partners Release Secure AI System Development Guidelines
The U.K. and U.S., along with international partners from 16 other countries, have released new guidelines for the development of secure artificial intelligence AI systems. "The approach prioritizes ownership of security outcomes for customers, embraces radical transparency and accountability, an...
cherubim-design.com Improper Access Control vulnerability OBB-3795570
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
The vulnerability of Cobalt Ashlar-Vellum’s software for parametric automated design and 3D modeling lies in its uncontrolled search element, allowing a perpetrator to execute arbitrary code.
The vulnerability of the Cobalt Ashlar-Vellum software for parametric automated design and 3D modeling is related to an uncontrollable element in the search process. Exploiting this vulnerability could allow a attacker to execute arbitrary code...
CISA and UK NCSC Unveil Joint Guidelines for Secure AI System Development
Today, in a landmark collaboration, the U.S. Cybersecurity and Infrastructure Security Agency CISA and the UK National Cyber Security Centre NCSC are proud to announce the release of the Guidelines for Secure AI System Developmentlink is external. Co-sealed by 23 domestic and international...
austinelectronicdesign.com Improper Access Control vulnerability OBB-3793522
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
Design/Logic Flaw
The use of proto in process.mainModule.proto.require can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time...
The vulnerability of the software for parametric automated design and 3D modeling of Lithium Ashlar-Vellum lies in its uncontrolled element during the search process, allowing a perpetrator to execute arbitrary code.
The vulnerability of the software for parametric automated design and 3D modeling of Lithium Ashlar-Vellum is related to an uncontrollable element in the search process. Exploiting this vulnerability could allow a attacker to execute arbitrary code...
Measures Healthcare Providers Can Take to Mitigate Disruptions
Earlier this month, an internet outage affected public healthcare clusters in Singapore, including major hospitals and polyclinics, lasting more than seven hours from 9:20 am. Investigations identified that a distributed denial-of-service DDoS attack was the cause of the online service outage. DD...
Design/Logic Flaw
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfupdatecategory function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above,...
Design/Logic Flaw
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfdeleteposts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...
Design/Logic Flaw
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfaf2triggerdarkmode function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and...