138 matches found
SUSE-SU-2022:3960-1 Security update for xen
This update for xen fixes the following issues: - CVE-2022-42311, CVE-2022-42312, CVE-2022-42313, CVE-2022-42314, CVE-2022-42315, CVE-2022-42316, CVE-2022-42317, CVE-2022-42318: xen: Xenstore: Guests can let xenstored run out of memory bsc1204482 - CVE-2022-42309: xen: Xenstore: Guests can crash...
CVE-2022-39945
An improper access control vulnerability CWE-284 in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an authenticated admin user assigned to a specific domain to access and modify other domains information via insecure direct object references...
PT-2022-25140 · Fortinet · Fortimail
Name of the Vulnerable Software and Affected Versions: FortiMail versions 6.0 through 7.2.0 Description: The issue allows an authenticated admin user assigned to a specific domain to access and modify other domains' information via insecure direct object references IDOR. This is due to an imprope...
ALPINE-CVE-2022-42320
Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are per domid. When a domain is gone, there might be Xenstore nodes left with access rights containing the domid of the removed domain. This is normally no problem, as those access right entries...
UBUNTU-CVE-2022-42320
Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are per domid. When a domain is gone, there might be Xenstore nodes left with access rights containing the domid of the removed domain. This is normally no problem, as those access right entries...
PT-2022-7334 · Xen +1 · Xenstore +1
Name of the Vulnerable Software and Affected Versions: Xenstore affected versions not specified Description: The issue is related to the Xenstore component of the Xen hypervisor, where guests can gain access to Xenstore nodes of deleted domains due to incomplete cleanup of temporary or auxiliary...
Error connecting to PVS Farm with Credentials from trusted domain using Selective Trust
When connecting to the PVS Farm "localhost" with credentials from a trusted domain, an error is thrown that reads: "Error Domain Controller" and "unable to connect to the domain Controller if any or the default rootDSE. Error code: 60075030, message: Access is denied Exception from HRESULT:...
GHSA-MR5M-2385-2VCP xdlocalstorage does not verify request origin
An issue was discovered in xdLocalStorage through 2.0.5. The postData function in xdLocalStoragePostMessageApi.js specifies the wildcard as the targetOrigin when calling the postMessage function on the parent object. Therefore any domain can load the application hosting the "magical iframe" and...
SolarWinds Serv-U FTP Server 访问控制错误漏洞
SolarWinds Serv-U FTP Server is a suite of FTP and MFT file transfer software from SolarWinds Corporation, USA. A security vulnerability exists in SolarWinds Serv-U FTP Server 15.3 and prior versions, which stems from the presence of improper access control in the application. An unauthorized...
CVE-2021-38874
IBM QRadar SIEM 7.3, 7.4, and 7.5 allows for users to access information across tenant and domain boundaries in some situations. IBM X-Force ID: 208397...
IBM QRadar SIEM 安全漏洞
IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, and more. IBM QRadar SIEM ha...
HCL BigFix Insights 安全漏洞
HCL BigFix Insights is HCL India's accelerates risk identification and decision making through elevated views of endpoint queue data, rich reporting and integration with existing business intelligence tools. HCL BigFix Insights has a security vulnerability that stems from the application storing...
Security Bulletin: IBM InfoSphere Information Server is vulnerable to insecure third party domain access (CVE-2021-29875)
Summary An insecure third party domain access vulnerability in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID: CVE-2021-29875 DESCRIPTION: IBM InfoSphere Information Server could allow an attacker to obtain sensitive information due to a insecure third party domain...
Online Project Time Management 1.0 SQL Injection
Title: Online Project Time Management 1.0 Multiple SQL - Injections Author: nu11secur1ty Date: 01.20.2022 Vendor: https://www.sourcecodester.com/users/tips23 Software: https://www.sourcecodester.com/php/15136/online-project-time-management-system-phpoop-free-source-code.html Description: The pid...
CVE-2021-20148
ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name. When ADSSP is configured with multiple Windows domains, a user from one domain can obtain the password policy for another...
CVE-2021-20148
ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name. When ADSSP is configured with multiple Windows domains, a user from one domain can obtain the password policy for another...
CVE-2021-45255
The email parameter from ajax.php of Video Sharing Website 1.0 appears to be vulnerable to SQL injection attacks. A payload injects a SQL sub-query that calls MySQL's loadfile function with a UNC file path that references a URL on an external domain. The application interacted with that domain,...
CVE-2021-36327
Dell EMC Streaming Data Platform versions before 1.3 contain a Server Side Request Forgery Vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to perform port scanning of internal networks and make HTTP requests to an arbitrary domain of the attacker's choi...
Samba 竞争条件问题漏洞
Samba is the standard Windows interoperability suite for Linux and Unix. A security vulnerability exists in Samba that stems from a flaw discovered in the way Samba, which acts as an Active Directory domain controller, implements Kerberos name-based authentication. An attacker could exploit this...