17960 matches found
Design/Logic Flaw
An Incomplete List of Disallowed Inputs vulnerability in Packet Forwarding Engine PFE of Juniper Networks Junos OS on QFX5000 Series and EX4600 Series allows an adjacent unauthenticated attacker which sends a high rate of specific multicast traffic to cause control traffic received from the netwo...
Design/Logic Flaw
An issue was discovered in function scanallsubs in src/sbbs3/scansubs.cpp in Synchronet BBS, which may allow attackers to view sensitive information due to an uninitialized value...
Design/Logic Flaw
An issue was discovered in function sofiahandlesipinotify in sofia.c in SignalWire freeswitch before 1.10.6, may allow attackers to view sensitive information due to an uninitialized value...
Design/Logic Flaw
The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements...
Design/Logic Flaw
The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python in pybluemonday, does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements...
Design/Logic Flaw
The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’s privilege, remote attackers can access and edit other users’ tutorial schedule by crafting URL parameters...
Design/Logic Flaw
In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4"...
Shanghai Anywhere Technology Co., Ltd Soul APP has information leakage vulnerability
Soul APP is a social platform for Generation Z based on interest mapping to build relationships and gamified gameplay for product design. Ltd. Soul APP has an information leakage vulnerability, which can be exploited by attackers to obtain sensitive information...
Zephyr Buffer Overflow Vulnerability (CNVD-2021-83788)
Zephyr is an open source, small, scalable, real-time operating system from the Linux Foundation in the U.S. A security vulnerability exists in Zephyr, which stems from improper design or implementation during the development of code for a networked system or product. No details of the vulnerabili...
Shanghai Anywhere Technology Co., Ltd Soul APP has a logic flaw vulnerability
Soul App is a social platform for Generation Z based on interest mapping to build relationships and gamified gameplay for product design. Ltd. Soul APP has a logic flaw vulnerability, which can be exploited by attackers to hijack the attack...
Ericsson Network Manager security vulnerability
Ericsson Network Manager is a network manager from Ericsson, Sweden. It covers monitoring, troubleshooting, configuration, automation and optimization of networks. Ericsson Network Manager has a security vulnerability that originates from improper design or implementation during code development ...
Design/Logic Flaw
The Profile Name field in the floor plan Network Menu page in Draytek VigorConnect 1.6.0-B3 was found to be vulnerable to stored XSS, as user input is not properly sanitized...
Design/Logic Flaw
Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 Vaadin 8.0.0 through 8.14.0 allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data...
Design/Logic Flaw
Debug function of Admin UI of SAP Business One Integration is enabled by default. This allows Admin User to see the captured packet contents which may include User credentials...
Puma environmental issues
Puma is a web server for highly concurrent applications by Evan Phoenix, an individual developer in the United States. Puma is vulnerable to an environmental issue that arises from improper design or implementation during code development of a web system or product...
Design/Logic Flaw
checksmart before 6.9.1 allows unintended drive access by an unprivileged user because it only checks for a substring match of a device path the /dev/bus substring and a number, aka an unanchored regular expression...
Design/Logic Flaw
The Easy Accordion WordPress plugin before 2.0.22 does not properly sanitize inputs when adding new items to an accordion...
Design/Logic Flaw
Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
Design/Logic Flaw
Use after free in Offline use in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page...