Design/Logic Flaw

QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application...

Design/Logic Flaw

Weak configuration in Automotive while VM is processing a listener request from TEE...

Design/Logic Flaw

Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Administrator on Linux allows local users to gain sensitive information.This issue affects Hitachi Ops Center Administrator: before 10.9.3-00...

Design/Logic Flaw

A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMode protection...

CVE-2023-40558: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in eMarket Design YouTube Video Gallery by YouTube Showcase plugin = 3.3.5 versions...

PT-2023-27510 · Unknown · Emarket Design Youtube Video Gallery

Name of the Vulnerable Software and Affected Versions: eMarket Design YouTube Video Gallery by YouTube Showcase plugin versions = 3.3.5 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web...

Design/Logic Flaw

A flaw exists in FlashBlade Purity whereby an authenticated user with access to FlashBlade’s object store protocol can impact the availability of the system’s data access and replication protocols...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none...

Debian: Security Advisory (DLA-3593-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Design/Logic Flaw

A vulnerability has been found in eeroOS up to 6.16.4-11 and classified as critical. This vulnerability affects unknown code of the component Ethernet Interface. The manipulation leads to denial of service. The attack needs to be approached within the local network. The exploit has been disclosed...

design-hero.ru Cross Site Scripting vulnerability OBB-3718926

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Design/Logic Flaw

A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory...

[SECURITY] [DLA 3593-1] gerbv security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3593-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk September 30, 2023 https://wiki.debian.org/LTS -...

Design/Logic Flaw

Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager...

Design/Logic Flaw

Denial-of-service in NodeBB = v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking eventName.startsWith or eventName.toString, while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for the event name respectively...

Design/Logic Flaw

The 'Email' parameter of the processlogin.php resource does not validate the characters received and they are sent unfiltered to the database...

Design/Logic Flaw

The 'bookisbn' parameter of the cart.php resource does not validate the characters received and they are sent unfiltered to the database...

Design/Logic Flaw

The 'search' parameter of the processsearch.php resource does not validate the characters received and they are sent unfiltered to the database...

Design/Logic Flaw

Use after free in Extensions in Google Chrome prior to 117.0.5938.132 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Design/Logic Flaw

Use after free in Passwords in Google Chrome prior to 117.0.5938.132 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via crafted UI interaction. Chromium security severity: High...