8705 matches found
Design/Logic Flaw
HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions...
CVE-2021-22850 HGiga OAKloud Portal - Security Misconfiguration
HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions...
CVE-2021-22850
CVE-2021-22850 concerns the HGiga EIP product, where an ineffective access control on certain pages permits attackers to access databases and perform privileged functions. The issue is described consistently across sources, with NVD citing two CVSS measurements: CVSS v2.0 base score 7.5 (HIGH) an...
CVE-2021-22850: Incorrect Permission Assignment for Critical Resource
HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions...
postgresql: Multiple features escape "security restricted operation" sandbox
A flaw was found in postgresql. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...
postgresql: Multiple features escape "security restricted operation" sandbox
A flaw was found in postgresql. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...
ByteDance-HIDS - A Cloud-Native Host-Based Intrusion Detection Solution Project To Provide Next-Generation Threat Detection And Behavior Audition With Modern Architecture
ByteDance-HIDS is a Cloud-Native Host-Based Intrusion Detection solution project to provide next-generation Threat Detection and Behavior Audition with modern architecture. ByteDance-HIDS comprises three major components： ByteDance-HIDS Agent, co-worked with ByteDance-HIDS Driver , is the...
Medium: vim
Issue Overview: A flaw was found in vim in the restricted mode, where all commands that make use of external shells are disabled. However, it was found that users could still execute some arbitrary OS commands in the restricted mode. This flaw was fixed by filtering the functions that can call OS...
Important: postgresql95, postgresql96
Issue Overview: A flaw was found in postgresql. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text...
Slack: Denial of Service via Hyperlinks in Posts
Summary Via html injection its possible to override all document functions, causing the application to crash because its using the element as a function. Brief explanation of how its possible override document functions with html injection: In some html elements, the name attribute becomes a...
panic safety: double drop or uninitialized drop of T upon panic
Affected versions of this crate did not guard against potential panics that may happen from user-provided functions T::default and T::drop. Panic within T::default leads to dropping uninitialized T, when it is invoked from common::Slice::::new. Panic within T::drop leads to double drop of T, when...
Remote Code Execution (RCE)
dubbo is vulnerable to remote code execution. The vulnerability exists because some functions in the classes stored in HasMap will be executed after a series of program calls via a crafted malicious request...
CVE-2021-3129
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of filegetcontents and fileputcontents. This is exploitable on sites using debug mode with Laravel before 8.4.2. Recent assessments: ccondon-r7...
Crimson Critical Function Missing Authentication Vulnerability
Crimson is a programming software from Red Lion. Crimson suffers from a lack of authentication vulnerability in critical functions. An attacker could exploit this vulnerability to read and modify databases without authentication in the default configuration...
Red Lion Controls Crimson: Access Control Vulnerability
Crimson is a programming software from Red Lion. Crimson suffers from a lack of authentication vulnerability in critical functions. An attacker could exploit this vulnerability to read and modify databases without authentication in the default configuration...
Unauthorized Access Vulnerability in Teaching Information Management System
Teaching Information Management System is a teaching information management system. An unauthorized access vulnerability exists in the Teaching Information Management System. An attacker can exploit the vulnerability by gaining unauthorized direct access to multiple functional pages in the...
CVE-2020-11832
In functions charginglimitcurrentwrite and charginglimittimewrite in /SM8250QMaster/android/vendor/oppocharger/oppo/oppocharger.c have not checked the parameters, which causes a vulnerability...
CVE-2020-17533
Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and...
CVE-2020-17533
Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and...
Code injection
Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and...