Design/Logic Flaw

In function readyincontainer in libyang extr is NULL. In some cases, it can be NULL, which leads to the operation of retval-extr-flags that results in a crash...

Design/Logic Flaw

In function readyinleaf in libyang extr is NULL. In some cases, it can be NULL, which leads to the operation of retval-extr-flags that results in a crash...

Design/Logic Flaw

There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to...

Design/Logic Flaw

modauthopenidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service DoS condition via unspecified vectors...

Design/Logic Flaw

In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allowing read-access to resources beyond what those users were explicitly allowed to access...

It is expected that some functions may require either Owner or Delegate as callers. Now only three access options are available: onlyOwner, onlyDelegate, anyone.

Handle Sherlock Vulnerability details Impact That is strange behavior that some functions are available for a Delegate, but not available for an owner himself. Like lock and unlock - according to the understanding of the Visor's design, these functions should be available for the owner as well...

SQL Injection Vulnerability in Jacko Web Design Studio Website Building System (CNVD-2021-39105)

Jacko Web Design Studio is an integrated communication agency with services such as website construction, graphic design and advertising production. A SQL injection vulnerability exists in the website building system of Jacko Web Design Studio. An attacker can exploit this vulnerability to obtain...

SQL Injection Vulnerability in Jacko Web Design Studio Website Building System (CNVD-2021-39106)

Jacko Web Design Studio is an integrated communication agency with services such as website construction, graphic design and advertising production. A SQL injection vulnerability exists in the website building system of Jacko Web Design Studio. An attacker can exploit this vulnerability to obtain...

Design/Logic Flaw

Use-after-Free vulnerability in cflow 1.6 in the void callchar name, int line function at src/parser.c, which could cause a denial of service via the pointer variable caller-callee...

Moderate: sqlite security update

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL databas...

IBM Cloud Pak for Security Logic Vulnerability

IBM Cloud Pak for Security is an application from IBM America, Inc. An open security platform that connects to your existing data sources to generate deeper insights and enables you to take automated action faster. A logic vulnerability exists in IBM Cloud Pak for Security versions 1.4.0.0,...

@qbunnyteam/superlogin (>=0.0.3 <=0.0.4), @sensu/superlogin (>=1.2.2 <=1.2.6) +16 more potentially affected by CVE-2020-7673 via node-extend (=0.2.0)

node-extend NPM version =0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on node-extend and may be impacted: - @qbunnyteam/superlogin =0.0.3, =1.2.2, =0.1.0, =0.1.0, =0.0.0, =0.2.0, =4.1.4, =1.1.0, =1.4.1 and more Source cves: CVE-2020-7673 Source...

Design/Logic Flaw

Firely/Incendi Spark before 1.5.5-r4 lacks Content-Disposition headers in certain situations, which may cause crafted files to be delivered to clients such that they are rendered directly in a victim's web browser...

Design/Logic Flaw

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a CHECK failure by passing an empty image to tf.rawops.DrawBoundingBoxes. This is because the...

Design/Logic Flaw

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a CHECK-fail in tf.rawops.SparseConcat. This is because the...

Design/Logic Flaw

IBM Planning Analytics Local 2.0 could allow an attacker to obtain sensitive information due to accepting body parameters in a query. IBM X-Force ID: 192642...

Design/Logic Flaw

Low privileged users can use the AJAX action 'cppluginsdobuttonjoblatercallback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12, to install any plugin including a specific version from the WordPress repository, as well as activate arbitrary plugin from then blog, which...

Design/Logic Flaw

Password generator feature in Kaspersky Password Manager was not completely cryptographically strong and potentially allowed an attacker to predict generated passwords in some cases. An attacker would need to know some additional information for example, time of password generation...

Design/Logic Flaw

Bitcoin Core 0.12.0 through 0.21.1 does not properly implement the replacement policy specified in BIP125, which makes it easier for attackers to trigger a loss of funds, or a denial of service attack against downstream projects such as Lightning network nodes. An unconfirmed child transaction wi...

Design/Logic Flaw

In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain cross-cluster search queries. This could result in the search disclosing the...