17088 matches found
Design/Logic Flaw
Accounting User Can Download Patient Reports in openemr in GitHub repository openemr/openemr prior to 6.1.0...
Design/Logic Flaw
An issue was discovered in Mediawiki through 1.37.1. The check for the override-antispoof permission in the AntiSpoof extension is incorrect...
Design/Logic Flaw
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data...
Design/Logic Flaw
A local attacker, as a different local user, may be able to send a HTTP request to 127.0.0.1:10000 after the user typically a developer manually invoked the ./tools/run-dev-server script. It is recommended to upgrade to any version beyond 24.2...
Design/Logic Flaw
Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to copy arbitrary files and directories from the Jenkins controller to the agent workspace...
designincubator.com Improper Access Control vulnerability OBB-2453607
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Design/Logic Flaw
UNSUPPORTED WHEN ASSIGNED A vulnerability classified as problematic was found in WEKA INTEREST Security Scanner up to 1.8. Affected by this vulnerability is the Stresstest Configuration Handler. A manipulation leads to a local denial of service. The exploit has been disclosed to the public and ma...
Design/Logic Flaw
Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 46dc8fcd...
Design/Logic Flaw
EyouCMS v1.5.4 was discovered to lack parameter filtering in \user\controller\shop.php, leading to payment logic vulnerabilities...
Design/Logic Flaw
OX App Suite through 7.10.5 allows XSS via an unknown system message in Chat...
WordPress Shopping Cart & eCommerce Store plugin <= 5.2.4 - Arbitrary Design Settings Update via Cross-Site Request Forgery (CSRF) vulnerability
Arbitrary Design Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by WPScanTeam in WordPress Shopping Cart & eCommerce Store plugin versions = 5.2.4. Solution Update the WordPress Shopping Cart & eCommerce Store plugin to the latest available version at least 5.2.5...
Shopping Cart & eCommerce Store < 5.2.5 - Arbitrary Design Settings Update via CSRF
The plugin is lacking CSRF checks in various AJAX actions, such as ecadminajaxsavedesignsettings, which could allow attackers to make a logged in admin update arbitrary settings To disable the Live Design Editor To set the custom CSS setting to body background-color: red;...
Shopping Cart & eCommerce Store < 5.2.5 - Arbitrary Design Settings Update via CSRF
The plugin is lacking CSRF checks in various AJAX actions, such as ecadminajaxsavedesignsettings, which could allow attackers to make a logged in admin update arbitrary settings PoC To disable the Live Design Editor To set the custom CSS setting to body background-color: red;...
Design/Logic Flaw
In DLink DAP-1360 F1 firmware version =v6.10 in the "webupg" binary, an attacker can use the "file" parameter to execute arbitrary system commands when the parameter is "name=deleteFile" after being authorized...
Design/Logic Flaw
libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangleconst, as demonstrated by nm-new...
Design/Logic Flaw
This vulnerability can be exploited by parsing maliciously crafted project files with Horner Automation Cscape EnvisionRV v4.50.3.1 and prior. The issues result from the lack of proper validation of user-supplied data, which can result in reads and writes past the end of allocated data structures...
A Bootiful Podcast: Event streaming guru Jan Svoboda on Apache Kafka Design Patterns
Hi, Spring fans! In this installment Josh Long @starbuxman talks to event streaming guru at Confluent, the company behind Apache Kafka, Jan Svoboda about Apache Kafka design patterns. Kafka summit in London Europe end of April 2022 Kafka Summit London 2022 | April 25-26 | London, UK the Confluent...
Design/Logic Flaw
Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0...