17071 matches found
Design/Logic Flaw
The wnoti system service in Samsung Galaxy Gear series allows an unprivileged process to take over the internal notification message data, due to improper D-Bus security policy configurations. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2...
Design/Logic Flaw
In postfix-mta-sts-resolver before 0.5.1, All users can receive incorrect response from daemon under rare conditions, rendering downgrade of effective STS policy...
Design/Logic Flaw
storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to privilege escalation. Local users can also create a plain file named /tmp/storeBackup.lock to block use of storeBackup until an admin manually deletes that fi...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
corp.designstudio.com Cross Site Scripting vulnerability
Security Researcher sido Helped patch 79 vulnerabilities Received 3 Coordinated Disclosure badges , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting corp.designstudio.com website and its users. Following coordinated and responsible...
Design/Logic Flaw
Jara 1.6 has an XSS vulnerability...
Design/Logic Flaw
KMS Controls BAC-A1616BC BACnet devices have a cleartext password of snowman in the BACKDOORNAME variable in the BCLogon.swf file...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2008-1382. Reason: This candidate is a reservation duplicate of CVE-2008-1382. Notes: All CVE users should reference CVE-2008-1382 instead of this candidate. All references and descriptions in this candidate have been removed to...
[SECURITY] Fedora 31 Update: python-django-2.2.9-1.fc31
Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...
Design/Logic Flaw
GE PACSystems RX3i CPE100/115: All versions prior to R9.85,CPE302/305/310/330/400/410: All versions prior to R9.90,CRU/320 All versionsEnd of Life may allow an attacker sending specially manipulated packets to cause the module state to change to halt-mode, resulting in a denial-of-service...
Design/Logic Flaw
Vulnerability in the Enterprise Manager for Oracle Database product of Oracle Enterprise Manager component: Enterprise Config Management. Supported versions that are affected are 12.1.0.5, 13.2.0.0 and 13.3.0.0. Easily exploitable vulnerability allows high privileged attacker with network access...
Design/Logic Flaw
JetBrains IDETalk plugin before version 193.4099.10 allows XXE...
Design/Logic Flaw
Joomla! 1.5x through 1.5.12: Missing JEXEC Check...
Design/Logic Flaw
whoopsie-daisy before 0.1.26: Root user can remove arbitrary files...
Design/Logic Flaw
Certain types of malformed Path Computation Element Protocol PCEP packets when received and processed by a Juniper Networks Junos OS device serving as a Path Computation Client PCC in a PCEP environment using Juniper's path computational element protocol daemon pccd process allows an attacker to...
Design/Logic Flaw
Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities login attempts depending on whether the user account exists, which might make it easier to enumerate users. However, only about 4 or 5 failed logins are...
Design/Logic Flaw
ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phase of the HMI interface...
Design/Logic Flaw
BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address...