Design/Logic Flaw

Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0...

Azure Storage Account Key Security Advisory

Purpose This article highlights a flaw in the design of Microsoft Azure roles that could lead to breaches between control and data planes. If a control plane user's account is compromised, it can be used to access and alter files stored in the storage accounts accessible to them. Cause The ListKe...

Fedora: Security Advisory for python-django3 (FEDORA-2023-0d20d09f2d)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Design/Logic Flaw

Adobe Substance 3D Painter versions 8.3.0 and earlier is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the...

Design/Logic Flaw

A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given channel, leaking private channel members to unauthorized users. This allows authenticated users to enumerate whether a username is a membe...

Design/Logic Flaw

Adobe Substance 3D Painter versions 8.3.0 and earlier is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the...

Design/Logic Flaw

Adobe Substance 3D Painter versions 8.3.0 and earlier is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in tha...

Design/Logic Flaw

In Lightbend Akka before 2.8.1, the async-dns resolver used by Discovery in DNS mode and transitively by Cluster Bootstrap uses predictable DNS transaction IDs when resolving DNS records, making DNS resolution subject to poisoning by an attacker. If the application performing discovery does not...

Design/Logic Flaw

in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the...

Design/Logic Flaw

podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfDictionary::findKeyParent...

Design/Logic Flaw

Access of memory location after end of buffer in some IntelR Server Board BMC firmware before version 2.90 may allow a privileged user to enable escalation of privilege via local access...

Design/Logic Flaw

Use after free in the IntelR VROC software before version 7.7.6.1003 may allow an authenticated user to potentially enable escalation of privilege via local access...

Design/Logic Flaw

Uncontrolled search path in the IntelR QuartusR Prime Pro edition software before version 22.3 may allow an authenticated user to potentially enable escalation of privilege via local access...

Design/Logic Flaw

Incorrect default permissions for the IntelR HDMI Firmware Update Tool for NUC before version 1.79.1.1 may allow an authenticated user to potentially enable escalation of privilege via local access...

Design/Logic Flaw

Uncontrolled search path in some IntelR oneAPI Toolkit and component software installers before version 4.3.0.251 may allow an authenticated user to potentially enable escalation of privilege via local access...

Design/Logic Flaw

When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read returns an error. In rare deployment cases error thrown by the Read function, this could lead to a predictable shared secret. The tkn20 and blindrsa components did not...

CVE-2023-23701

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Andrew @ Geeenville Web Design Easy Sign Up plugin = 3.4.1 versions...

CVE-2023-23701

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Andrew @ Geeenville Web Design Easy Sign Up plugin = 3.4.1 versions...

CVE-2023-23701 WordPress Easy Sign Up Plugin <= 3.4.1 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Andrew @ Geeenville Web Design Easy Sign Up plugin = 3.4.1 versions...

Design/Logic Flaw

JB Inquiry form contains an exposure of private personal information to an unauthorized actor vulnerability, which may allow a remote unauthenticated attacker to obtain information entered from forms created using the affected product. The affected products and versions are as follows: JB Inquiry...