17108 matches found
Design/Logic Flaw
QEMU 4.2.0 has a use-after-free in hw/net/e1000ecore.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address...
Design/Logic Flaw
On Juniper Networks Junos OS and Junos OS Evolved devices, processing a specific BGP packet can lead to a routing process daemon RPD crash and restart. This issue can occur even before the BGP session with the peer is established. Repeated receipt of this specific BGP packet can result in an...
Design/Logic Flaw
OpenNMS is accessible via port 9443...
Hyperledger: Vulnerability in Private Data Endorsement Policy Management in Hyperledger Fabric 2.0
To whom it may concern, We are a research group conducting research on the Hyperledger Fabric. We find a design flaw about the endorsement policy of Private Data related transactions in Hyperledger Fabric 2.0. When private data adopts a default chaincode-level MAJORITY endorsement policy, the...
Design/Logic Flaw
This affects all versions of package rollup-plugin-serve. There is no path sanitization in readFile operation...
Design/Logic Flaw
LibreHealth EMR v2.0.0 is affected by a Local File Inclusion issue allowing arbitrary PHP to be included and executed within the EMR application...
Design/Logic Flaw
Silverstripe CMS sites through 4.4.4 which have opted into HTTP Cache Headers on responses served by the framework's HTTP layer can be vulnerable to web cache poisoning. Through modifying the X-Original-Url and X-HTTP-Method-Override headers, responses with malicious HTTP headers can return...
Design/Logic Flaw
Vulnerability in the Oracle SD-WAN Edge product of Oracle Communications Applications component: User Interface. Supported versions that are affected are 8.2 and 9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SD-WAN Edge...
Design/Logic Flaw
An issue was discovered in Joomla! through 3.9.19. Missing validation checks on the usergroups table object can result in a broken site configuration...
Bitcoin wxBitcoin/bitcoind Design Error Vulnerability
A vulnerability exists in Bitcoin wxBitcoin and bitcoind 0.3.x versions. A remote attacker could exploit this vulnerability to cause a denial of service power drain via a Bitcoin transaction containing multiple OPCHECKSIG script opcodes...
Design/Logic Flaw
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php...
Design/Logic Flaw
libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName SAN. This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-14159. Reason: This candidate is a reservation duplicate of CVE-2020-14159. Notes: All CVE users should reference CVE-2020-14159 instead of this candidate. All references and descriptions in this candidate have been removed t...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none...
The vulnerability of the Adobe Experience Design (Adobe XD) interface development program exists due to an incorrect path name limitation for the restricted access catalog. This allows a malicious actor to execute arbitrary code.
The vulnerability of the Adobe Experience Design Adobe XD interface development software exists due to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code in the context of the current user...
Design/Logic Flaw
ZoneAlarm Firewall and Antivirus products before version 15.8.109.18436 allow an attacker who already has access to the system to execute code at elevated privileges through a combination of file permission manipulation and exploitation of Windows CVE-2020-00896 on unpatched systems...
Design/Logic Flaw
In all versions of the package jspdf, it is possible to use script in order to go over the filtering regex...
Design/Logic Flaw
An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress. Persistent XSS can occur via any of the registration fields...
Design/Logic Flaw
VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, which allows unprivileged users to achieve total control over filesystem I/O requests...