17899 matches found
Design/Logic Flaw
onlinetolls in cdSoft Onlinetools-Smart Winhotel.MX 2021 allows an attacker to download sensitive information about any customer e.g., data of birth, full address, mail information, and phone number via GastKont Insecure Direct Object Reference...
Design/Logic Flaw
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user...
Design/Logic Flaw
Observable behavioral discrepancy in some IntelR Processors may allow an authorized user to potentially enable information disclosure via local access...
Design/Logic Flaw
Insufficient control flow management in the IntelR Advisor software before version 7.6.0.37 may allow an authenticated user to potentially enable escalation of privilege via local access...
Design/Logic Flaw
SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. The issue was fixed in Ktor version 2.0.1...
Design/Logic Flaw
The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACESEIZE code path allows attackers to bypass intended restrictions on setting the PTSUSPENDSECCOMP flag...
Wondershare Dr.Fone 12.0.7 - Privilege Escalation (InstallAssistService) Exploit
Exploit Title: Wondershare Dr.Fone 12.0.7 - Privilege Escalation InstallAssistService Exploit Author: Netanel Cohen & Tomer Peled Vendor Homepage: https://drfone.wondershare.net/ Software Link: https://download.wondershare.net/drfonefull4008.exe Version: up to 12.0.7 Tested on: Windows 10 CVE :...
CVE-2022-28244
CVE-2022-28244 (Adobe Acrobat/Reader DC CSP Bypass) affects Acrobat Reader DC with versions up to 22.001.20085, 20.005.3031x, and 17.012.30205 (and earlier). The issue is a violation of secure design principles: bypassing the Content Security Policy, which could let an attacker trigger arbitraril...
Design/Logic Flaw
Insufficient bound checks in the System Management Unit SMU may result in access to an invalid address space that could result in denial of service...
Design/Logic Flaw
An issue has been discovered in GitLab affecting all versions starting from 13.9 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly handling malicious text in the CI Editor and CI Pipeline details page allowing t...
Design/Logic Flaw
An issue was found in bludit v3.13.0, unsafe implementation of the backup plugin allows attackers to upload arbitrary files...
Design/Logic Flaw
In placeCall of TelecomManager.java, there is a possible way for an application to keep itself running with foreground service importance due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed fo...
Design/Logic Flaw
Failure to verify SEV-ES TMR is not in MMIO space, SEV-ES FW could result in a potential loss of integrity or availability...
Design/Logic Flaw
There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including KernelFloat and Stringtof...
Design/Logic Flaw
IBM Robotic Process Automation 21.0.1 could allow a register user on the system to physically delete a queue that could cause disruption for any scripts dependent on the queue. IBM X-Force ID: 218366...
Design/Logic Flaw
Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses...
Design/Logic Flaw
OCI OpenDDS versions prior to 3.18.1 are vulnerable when an attacker sends a specially crafted packet to flood target devices with unwanted traffic, which may result in a denial-of-service condition and information exposure...
Yokogawa CENTUM VP Automation Design SCADA Network Protocol Exploitation
The vulnerability of the server network protocol implementation in the Automation Design SCADA system of Yokogawa CENTUM VP is related to errors during the authentication process. Exploiting this vulnerability allows a malicious actor to utilize the features provided by the AD server...
Design/Logic Flaw
On May 4, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in Clam AntiVirus ClamAV versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2 could allow an authenticated, local attacker to cause a denial of...