17077 matches found
Design/Logic Flaw
Monstra CMS 3.0.4 and earlier has XSS via index.php...
Design/Logic Flaw
BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Security/Security.cs, login.aspx, and register.aspx...
Design/Logic Flaw
fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter function is...
Design/Logic Flaw
Linear eMerge E3-Series devices allow File Inclusion...
Design/Logic Flaw
Linear eMerge E3-Series devices have Cleartext Credentials in a Database...
Design/Logic Flaw
Optergy Proton/Enterprise devices allow Username Disclosure...
Design/Logic Flaw
Super Micro SuperDoctor 5, when restrictions are not implemented in agent.cfg, allows remote attackers to execute arbitrary commands via NRPE...
Design/Logic Flaw
IBM Robotic Process Automation with Automation Anywhere 11 could allow a local user to obtain highly sensitive information from log files when debugging is enabled. IBM X-Force ID: 160765...
Design/Logic Flaw
When using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle, DB2 or MongoDB databases, a redirected restore operation specifying a target path may allow execution of arbitrary code on the system. IBM X-Force ID: 161667,...
Design/Logic Flaw
Use after free in file chooser in Google Chrome prior to 74.0.3729.108 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page...
Design/Logic Flaw
Use of extended attributes in downloads in Google Chrome prior to 72.0.3626.81 allowed a local attacker to read download URLs via the filesystem...
Design/Logic Flaw
Insufficient policy enforcement in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to bypass same origin policy via a crafted HTML page...
Design/Logic Flaw
Use after free in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
Design/Logic Flaw
A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to internal URLs...
Design/Logic Flaw
PC-Doctor Toolbox before 7.3 has an Uncontrolled Search Path Element...
Design/Logic Flaw
In Xpdf 4.01.01, a buffer over-read could be triggered in FoFiType1C::convertToType1 in fofi/FoFiType1C.cc when the index number is larger than the charset array bounds. It can, for example, be triggered by sending a crafted PDF document to the pdftops tool. It allows an attacker to use a crafted...
PRODSECBUG-2296: Arbitrary code execution through design layout update
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2298: Arbitrary code execution through product imports and design layout update
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
CVE-2014-9699
The MakerBot Replicator 5G printer runs an Apache HTTP Server with directory indexing enabled. Apache logs, system logs, design files i.e., a history of print files, and more are exposed to unauthenticated attackers through this HTTP server...
Directory traversal
The MakerBot Replicator 5G printer runs an Apache HTTP Server with directory indexing enabled. Apache logs, system logs, design files i.e., a history of print files, and more are exposed to unauthenticated attackers through this HTTP server...