18094 matches found
Design/Logic Flaw
In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note: the fixing commit was applied to all...
CVE-2020-6870: Undefined Security Weakness
The version V12.17.20T115 of ZTE U31R20 product is impacted by a design error vulnerability. An attacker could exploit the vulnerability to log in to the FTP server to tamper with the password, and illegally download, modify, upload, or delete files, causing improper operation of the network...
Design/Logic Flaw
GNS3 ubridge through 0.9.18 on macOS, as used in GNS3 server before 2.1.17, allows a local attacker to read arbitrary files because it handles configuration-file errors by printing the configuration file while executing in a setuid root context...
Design/Logic Flaw
Use after free issue in camera applications when used randomly over multiple operations due to pointer not set to NULL after free/destroy of the object in Snapdragon Consumer IOT, Snapdragon Mobile in Kamorta, QCS605, Rennell, Saipan, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SM8250, SXR113...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
Mattermost Server Code Issue Vulnerability (CNVD-2020-35442)
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A code issue vulnerability exists in Mattermost Server that arises from improper design or implementation during code development of a network system or product. No detailed vulnerability details ar...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to add DEBUG lines to the logs via a REST API version 3 logging endpoint...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 5.8.0. The first user is sometimes inadvertently a system admin...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 5.8.0. It does not always generate a robots.txt file...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 5.17.0. It allows remote attackers to cause a denial of service client-side application crash via a LaTeX message...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 5.15.0. Login access control can be bypassed via crafted input...
Design/Logic Flaw
An issue was discovered in Mattermost Mobile Apps before 1.29.0. The iOS app allowed Single Sign-On cookies and Local Storage to remain after a logout, aka MMSA-2020-0013...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There are weak permissions for configuration files...
[SECURITY] Fedora 31 Update: python-django-2.2.13-1.fc31
Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...
[SECURITY] Fedora 32 Update: python-django-3.0.7-1.fc32
Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...
Design/Logic Flaw
Convos before 4.20 does not properly generate a random secret in Core/Settings.pm and Util.pm. This leads to a predictable CONVOSLOCALSECRET value, affecting password resets and invitations...
Design/Logic Flaw
Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface...