17108 matches found
Design/Logic Flaw
ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality...
Design/Logic Flaw
In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable due to the usage of old jQuery libraries...
Design/Logic Flaw
An issue was discovered on Samsung mobile devices with O8.x software. Attackers can bypass Factory Reset Protection FRP via an external keyboard. The Samsung ID is SVE-2019-15164 October 2019...
Design/Logic Flaw
The command-line "safety" package for Python has a potential security issue. There are two Python characteristics that allow malicious code to “poison-pill” command-line Safety package detection routines by disguising, or obfuscating, other malicious or non-secure packages. This vulnerability is...
Design/Logic Flaw
In Rockwell Automation all versions of FactoryTalk Diagnostics software, a subsystem of the FactoryTalk Services Platform, FactoryTalk Diagnostics exposes a .NET Remoting endpoint via RNADiagnosticsSrv.exe at TCPtcp/8082, which can insecurely deserialize untrusted data...
Design/Logic Flaw
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS Versions 14 and prior using the service: IGSSupdate, which could allow a remote unauthenticated attacker to read arbitrary files from the IGSS server PC on an unrestricted or shared network when the IGSS Update...
Design/Logic Flaw
This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.1-47117. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw...
Design/Logic Flaw
Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager SCCM database username when dynamically generating a command to schedule scans for SCCM. This allows an attacker to execute arbitrary commands on the AssetExplorer Server with NT AUTHORITY/SYSTEM...
Design/Logic Flaw
AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE...
Design/Logic Flaw
Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
User Survey 2020 Report Shows Rapid Growth In Apache Pulsar Adoption
For the first time ever, the Apache Pulsar PMC team is publishing a user survey report. The 2020 Apache Pulsar User Survey Report reveals Pulsar's accelerating rate of global adoption, details how organizations are leveraging Pulsar to build real-time streaming applications, and highlights key...
form.ux-design-awards.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1122447 Security Researcher metamorfosec Helped patch 1961 vulnerabilities Received 9 Coordinated Disclosure badges Received 31 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting...
Design/Logic Flaw
Xmidt cjwt through 1.0.1 before 2019-11-25 maps unsupported algorithms to alg=none, which sometimes leads to untrusted accidental JWT acceptance...
Design/Logic Flaw
The tfocommon component in HwordApp.dll in Hancom Office 9.6.1.7634 allows a use-after-free via a crafted .docx file...
ONAP Service Design and Creation Code Injection Vulnerability (CNVD-2020-24670)
ONAP Service Design and Creation SDC is a set of visual modeling and design tools for the ONAP project. A code injection vulnerability exists in previous versions of ONAP SDNC Dublin. An attacker can exploit this vulnerability to execute arbitrary code by accessing port 4000 of the demo-sdc-sdc-b...
ONAP Service Design and Creation Code Injection Vulnerability (CNVD-2020-24671)
ONAP Service Design and Creation SDC is a set of visual modeling and design tools for the ONAP project. A code injection vulnerability exists in ONAP SDC Dublin and prior versions, which stems from faulty access control. A remote attacker can exploit this vulnerability by accessing port 6000 of t...
ONAP Service Design and Creation Code Injection Vulnerability (CNVD-2020-24673)
ONAP Service Design and Creation SDC is a set of visual modeling and design tools for the ONAP project. A code injection vulnerability exists in ONAP SDC Dublin and prior versions that stems from faulty access control. A remote attacker can exploit this vulnerability by accessing port 7001 of the...
Microsoft VSCode Python Extension - Code Execution Exploit
VSCode Python Extension Code Execution This repository contains the Proof-of-Concept of a code execution vulnerability discovered in the Visual Studio Code Python extension. TL;DR: VScode may use code from a virtualenv found in the project folders without asking the user, for things such as...
ONAP Service Design and Creation Code Injection Vulnerability (CNVD-2020-24672)
ONAP Service Design and Creation SDC is a set of visual modeling and design tools for the ONAP project. A code injection vulnerability exists in ONAP SDC Dublin and prior versions that stems from faulty access control. A remote attacker can exploit this vulnerability by accessing port 4001 of the...