15751 matches found
PT-2023-8188 · Go +9 · Go +9
Name of the Vulnerable Software and Affected Versions: Go versions prior to 1.21.5 Go versions prior to 1.20.12 Description: The issue is related to the use of the "go get" command to fetch modules with the ".git" suffix. If the module is unavailable via secure protocols, it may fallback to the...
CVE-2023-40089
In getCredentialManagerPolicy of DevicePolicyManagerService.java, there is a possible method for users to select credential managers without permission due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User...
CVE-2023-24048
Cross Site Request Forgery CSRF vulnerability in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain control of the device via crafted GET request to /manpassword.htm...
Cross site request forgery (csrf)
Cross Site Request Forgery CSRF vulnerability in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain control of the device via crafted GET request to /manpassword.htm...
GHSA-GQJ2-324P-VX73 Microcks contains a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download
Microcks up to version 1.17.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /jobs and /artifact/download. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request...
Microcks contains a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download
Microcks up to version 1.17.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /jobs and /artifact/download. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request...
Microcks Security Vulnerabilities
Microcks is an open source Kubernetes tool for API simulation and testing. A security vulnerability exists in Microcks version 1.17.1 and prior versions. An attacker could exploit the vulnerability to access network resources and sensitive information via a specially crafted GET request...
CVE-2023-48910
Microcks up to 1.17.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /jobs and /artifact/download. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request...
CVE-2023-24048
Cross Site Request Forgery CSRF vulnerability in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain control of the device via crafted GET request to /manpassword.htm...
CVE-2023-24048
The CVE-2023-24048 entry concerns a CSRF vulnerability in Connectize AC21000 G6 641.139.1.1256. The description states that attackers can gain control of the device via a crafted GET request to /man_password.htm. The connected Red Hat CVE entries reiterate the same description but there is no add...
Connectize G6 AC2100 Security Vulnerability
The Connectize G6 AC2100 is a wireless router from Connectize. A security vulnerability exists in the Connectize G6 AC2100 version 641.139.1.1256, which stems from the presence of a cross-site request forgery CSRF vulnerability. An attacker could exploit the vulnerability to take control of the...
PT-2023-35625 · Hdf5 · Hdf5
Name of the Vulnerable Software and Affected Versions: HDF5 affected versions not specified Description: A heap buffer overflow read issue has been identified, which can cause a crash. The crash occurs in the H5T bit copy, H5T bit get d, and H5T conv f f functions. Recommendations: At the moment,...
Path traversal
Absolute path traversal vulnerability in the Systematica SMTP Adapter component up to v2.0.1.101 in Systematica Radius up to v.3.9.256.777 allows remote attackers to read arbitrary files via a full pathname in GET parameter "file" in URL. Also: affected components in same product - HTTP Adapter u...
CVE-2023-48963
Tenda i6 V1.0.0.83856 is vulnerable to Buffer Overflow via /goform/wifiSSIDget...
Malicious code in get-twitter-status (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 992f6ba616e5ed005fc045132424ad5c64e7a9d61fb073bb5891bd7f5c3f9f0c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8645 Malicious code in get-twitter-status (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 992f6ba616e5ed005fc045132424ad5c64e7a9d61fb073bb5891bd7f5c3f9f0c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2021-35975
Absolute path traversal vulnerability in the Systematica SMTP Adapter component up to v2.0.1.101 in Systematica Radius up to v.3.9.256.777 allows remote attackers to read arbitrary files via a full pathname in GET parameter "file" in URL. Also: affected components in same product - HTTP Adapter u...
python-werkzeug: high resource usage when parsing multipart form data with many fields
A flaw was found in python-werkzeug. Werkzeug is multipart form data parser, that will parse an unlimited number of parts, including file parts. These parts can be a small amount of bytes, but each requires CPU time to parse, and may use more memory as Python data. If a request can be made to an...
google-translate-api-browser Server-Side Request Forgery (SSRF) Vulnerability
Summary A Server-Side Request Forgery SSRF Vulnerability is present in applications utilizing the google-translate-api-browser package and exposing the translateOptions to the end user. An attacker can set a malicious tld, causing the application to return unsafe URLs pointing towards local...