17063 matches found
Design/Logic Flaw
An issue in Golden v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token...
Design/Logic Flaw
An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."...
Design/Logic Flaw
The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids. This will have an impact on confidentiality but there is no other impact on integrity or availability...
Design/Logic Flaw
A vulnerability, which was classified as problematic, was found in Maiwei Safety Production Control Platform 4.1. Affected is an unknown function of the file /Content/Plugins/uploader/FileChoose.html?fileUrl=/Upload/File/Pics/&parent. The manipulation leads to unrestricted upload. It is possible ...
Design/Logic Flaw
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer...
Design/Logic Flaw
Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the stable branch and version 3.2.0.beta3 of the beta and tests-passed branches, if a user has been quoted and uses a | in their full name, they might be able to trigger a bug that generates a lot of duplicat...
MAL-2023-8503 Malicious code in @atea/common-design-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2329fd9b04f0c2f8d8db0bf754737afd91b53c559c6dfa3aaf3c1f337323f9c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Design/Logic Flaw
Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 and other vehicles of the VW Group with the same hardware and spoof volume setting commands to irreversibly turn on audio volume to maximum via REST API calls...
Design/Logic Flaw
The course upload preview contained an XSS risk for users uploading unsafe data...
Design/Logic Flaw
blockreassurance adds an information block aimed at offering helpful information to reassure customers that their store is trustworthy. An ajax function in module blockreassurance allows modifying any value in the configuration table. This vulnerability has been patched in version 5.1.4...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
The vulnerability of Siemens Solid Edge’s design and simulation tools relates to the use of an uninitialized pointer on the stack, allowing a malicious actor to execute arbitrary code within the context of the current process.
The vulnerability of the Siemens Solid Edge design and simulation tools is related to the use of an uninitialized pointer on the stack. Exploiting this vulnerability could allow an attacker to execute arbitrary code within the context of the current process, through the use of specially created P...
Design/Logic Flaw
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information...
Design/Logic Flaw
The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution...
Design/Logic Flaw
Use after free in WebAudio in Google Chrome prior to 119.0.6045.123 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
Design/Logic Flaw
The Spotfire Connectors component of TIBCO Software Inc.'s Spotfire Analyst, Spotfire Server, and Spotfire for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with read/write access to craft malicious Analyst files. A successful attack using this...
Design/Logic Flaw
Permission control vulnerability in the window management module. Successful exploitation of this vulnerability may cause malicious pop-up windows...