17892 matches found
Adobe Experience Manager 6.5.0.0 < 6.5.14.0 Multiple Vulnerabilities (APSB22-40)
The version of Adobe Experience Manager installed on the remote host is prior to 6.5.14.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB22-40 advisory. - Adobe Experience Manager versions 6.5.13.0 and earlier is affected by a reflected Cross-Site Scripting XSS...
antoniodesignoribus.com Cross Site Scripting vulnerability OBB-2909843
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Design/Logic Flaw
An issue in the IGB Files and OutfileService features of SmartVista Cardgen v3.28.0 allows attackers to list and download arbitrary files via modifying the PATH parameter...
Design/Logic Flaw
Use after free vulnerability in mtpsendsignal function of MTP driver prior to SMR Sep-2022 Release 1 allows attackers to perform malicious actions...
Design/Logic Flaw
Out of bound read in libapexjni.media.samsung.so prior to SMR Sep-2022 Release 1 allows attacker access unauthorized information...
Design/Logic Flaw
A use-after-free vulnerability was found in systemd. This issue occurs due to the onstreamio function and dnsstreamcomplete function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the...
Design/Logic Flaw
In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing packages...
Design/Logic Flaw
An issue was discovered in Samsung TizenRT through 3.0GBM and 3.1PRE. cyasslconnectstep2 in curl/vtls/cyassl.c has a missing X509free after SSLgetpeercertificate, leading to information disclosure...
Design/Logic Flaw
Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of decoy users via a crafted GET request sent to /WebApp/DeceptionUser/GetAllDeceptionUsers...
Malicious Package
Overview @creditkudos/design-foundations is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable i...
Design/Logic Flaw
ftcms 2.1 poster.PHP has a XSS vulnerability. The attacker inserts malicious JavaScript code into the web page, causing the user / administrator to trigger malicious code when accessing...
Design/Logic Flaw
Use After Free in GitHub repository vim/vim prior to 9.0.0389...
Design/Logic Flaw
Blackboard Learn 1.10.1 allows remote authenticated users to read unintended files by entering student credentials and then directly visiting a certain webapps/bbcms/execute/ URL...
WS-2022-0351
In outline/outline, an incorrect API design lead to Site wide CSRF. By design, the api body only accepts is json values. But sending non-json values is also possible, beside, api accept auth from accessToken in Cookie. All of that leads to many other consequences, typically CSRF...
Design/Logic Flaw
Use After Free in GitHub repository vim/vim prior to 9.0.0360...
Warning: PyPI Feature Executes Code Automatically After Python Package Download
In another finding that could expose developers to increased risk of a supply chain attack, it has emerged that nearly one-third of the packages in PyPI, the Python Package Index, trigger automatic code execution upon downloading them. "A worrying feature in pip/PyPI allows code to automatically...
Design/Logic Flaw
BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate paramslen...
Design/Logic Flaw
The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for CVE-2020-14370, which was previously fixed via RHSA-2020:5056. This issue could possibly allow an attacker to gain access to sensitive...
Design/Logic Flaw
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a local attacker to obtain information due to the autocomplete feature on password input fields. IBM X-Force ID: 214345...