17063 matches found
Design/Logic Flaw
An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin Weixin.php component...
Fedora: Security Advisory for libspf2 (FEDORA-2023-ae340c92ea)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Design/Logic Flaw
langchainexperimental aka LangChain Experimental in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via import in Python code, which is not prohibited by palchain/base.py...
Design/Logic Flaw
Cleartext Transmission of Sensitive Information in RDT400 in SICK APU allows an unprivileged remote attacker to retrieve potentially sensitive information via intercepting network traffic that is not encrypted...
[SECURITY] Fedora 38 Update: libspf2-1.2.11-11.20210922git4915c308.fc38
libspf2 is an implementation of the SPF Sender Policy Framework specification as found at: http://www.ietf.org/internet-drafts/draft-mengwong-spf-00.txt SPF allows email systems to check SPF DNS records and make sure that an email is authorized by the administrator of the domain name that it is...
Design/Logic Flaw
In FW-PackageManager, there is a possible missing permission check. This could lead to local escalation of privilege with System execution privileges needed...
Design/Logic Flaw
DISPUTED libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't...
CVE-2023-29235
Cross-Site Request Forgery CSRF vulnerability in Fugu Design Maintenance Switch maintenance-switch allows Cross Site Request Forgery.This issue affects Maintenance Switch: from n/a through = 1.7.1...
Zenario CMS Cross-Site Scripting Vulnerability
Zenario CMS is a Zenario open source application . Provides a Web-based content management system. A cross-site scripting vulnerability exists in Zenario CMS version v.9.4.59197, which stems from the presence of a cross-site scripting XSS vulnerability. An attacker can exploit this vulnerability ...
Design/Logic Flaw
Line directives "//line" can be used to bypass the restrictions on "//go:cgo" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of...
NSA and CISA Release Advisory on Top Ten Cybersecurity Misconfigurations
Today, the National Security Agency NSA and Cybersecurity and Infrastructure Security Agency CISA released a joint cybersecurity advisory CSA, NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations, which provides the most common cybersecurity misconfigurations in large...
NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations
A plea for network defenders and software manufacturers to fix common problems. EXECUTIVE SUMMARY The National Security Agency NSA and Cybersecurity and Infrastructure Security Agency CISA are releasing this joint cybersecurity advisory CSA to highlight the most common cybersecurity...
Design/Logic Flaw
TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifetime may allow a device to be added outside of valid TouchLink range or pairing duration This issue affects Ember ZNet 7.1.x from 7.1.3...
Design/Logic Flaw
Hydra is the two-layer scalability solution for Cardano. Prior to version 0.13.0, it is possible for a malicious head initializer to extract one or more PTs for the head they are initializing due to incorrect data validation logic in the head token minting policy which then results in an flawed...
Design/Logic Flaw
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6...
Design/Logic Flaw
The 'sReferencia', 'sDescripcion', 'txtCodigo' and 'txtDescripcion' parameters, in the frmGestionStock.aspx and frmEditServicio.aspx files in TCMAN GIM v8.0.1, could allow an attacker to perform persistent XSS attacks...
Design/Logic Flaw
An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise...
CVE-2023-25980
Cross-Site Request Forgery CSRF vulnerability in CAGE Web Design | Rolf van Gelder Optimize Database after Deleting Revisions plugin = 5.1 versions...
