Mistakes were Made, Lessons were Learned

Mark Nunnikhoven, AWS Community Hero and Trend Micro Vice President of Cloud Research, explores how to leverage the AWS Well Architected Framework, and six core design principles to build in the AWS cloud with confidence...

GitLab: Reporters can upload design to issues using the "Move to" feature

Summary According to the permission documentation, only role of Developer or more can upload Design Management files. However, using the issue "Move to" feature, a reporter can create a issue with designs. Steps to reproduce 1. Consider a private project say Private Project with a member Reporter...

Design/Logic Flaw

LMA ISIDA Retriever 5.2 is vulnerable to XSS via query'text'...

Design/Logic Flaw

An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory. This was addressed by adding a new prompt. This vulnerability affects Firefox 85...

PT-2021-3516

Name of the Vulnerable Software and Affected Versions Autodesk Design Review versions 2011 through 2018 Description A Double Free issue in the PDF file parsing functionality of Autodesk Design Review allows remote attackers to execute arbitrary code. This requires user interaction, where the targ...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none...

Fluent Bit Code Issue Vulnerability

Fluent Bit is an open source log processing and analysis system written in C. A code issue vulnerability exists in Fluent Bit that arises from improper design or implementation during code development of a networked system or product. No detailed vulnerability details are provided at this time...

Design/Logic Flaw

UNSUPPORTED WHEN ASSIGNED In Directus 8.x through 8.8.1, an attacker can see all users in the CMS using the API /users/id. For each call, they get in response a lot of information about the user such as email address, first name, and last name but also the secret for 2FA if one exists. This secre...

Design/Logic Flaw

UNSUPPORTED WHEN ASSIGNED In Directus 8.x through 8.8.1, an attacker can discover whether a user is present in the database through the password reset feature. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Design/Logic Flaw

In ImageMagick, there is an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h. This flaw affects ImageMagick versions prior to 7.0.9-0...

Design/Logic Flaw

Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Design/Logic Flaw

Use after free in Downloads in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page...

Design/Logic Flaw

In webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter, which can lead to local file inclusion...

Design/Logic Flaw

The Contact page in Monica 2.19.1 allows stored XSS via the Middle Name field...

Design/Logic Flaw

The Contact page in Monica 2.19.1 allows stored XSS via the Nickname field...

Design/Logic Flaw

Use after free issue in audio modules while removing and freeing objects during list iteration due to incorrect usage of macro in Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile...