10318 matches found
ftp.claridenglobal.com Cross Site Scripting vulnerability OBB-4038045
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
11 Nation-State Hackers Exploit Unpatched Windows Flaw Since 2017
Microsoft refuses to patch serious Windows shortcut vulnerability abused in global espionage campaigns!...
The vulnerability of the `trace_clock_global()` function in the kernel/trace/trace_clock.c module, which supports Linux operating system kernel tracing, allows a hacker to cause a service failure.
The vulnerability of the traceclockglobal function in the kernel/trace/traceclock.c file, which supports Linux operating system debugging, is related to the occurrence of mutual locking. Exploiting this vulnerability could allow an attacker to cause a service failure...
The vulnerability of the `ocfs2_get_next_id()` function in the `fs/ocfs2/quota_global.c` module of the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the ocfs2getnextid function in the fs/ocfs2/quotaglobal.c module of the Linux kernel is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...
Security Bulletin: IBM Sterling Global Availability Mailbox is affected by a vulnerability in Cassandra Reaper
Summary Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests. Mitigation: Update to Apache Shiro 1.12.0+ or...
X.Org: Xwayland: Use-after-free of the root cursor
A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free...
X.Org: Xwayland: Use-after-free of the root cursor
A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free...
X.Org: Xwayland: Use-after-free of the root cursor
A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free...
X.Org: Xwayland: Use-after-free of the root cursor
A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free...
X.Org: Xwayland: Use-after-free of the root cursor
A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free...
X.Org: Xwayland: Use-after-free of the root cursor
A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free...
gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
...
Prototype Pollution
Vue I18n is vulnerable to Prototype Pollution. The vulnerability is due to improper input handling in the handleFlatJson function, allowing an attacker to modify the global prototype chain, potentially leading to denial of service DoS or more severe injection-based attacks...
Cloudflare Public Bug Bounty: Bypass of Cloudflare's Cache Keys and WAF via header overflow
A limitation in the HTTP request header parsing in Front Line FL processing enabled attackers to bypass defined rulesets. The maximum amount of headers being parsed by openresty was 100 HTTP headers including internal ones. This problem applied to any ruleset on HTTP headers. Attackers were able ...
CVE-2024-28607
The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses such as 0x7f.1 are improperly categorized as globally routable via a falsy isPrivate return value...
AWS VDP: Non-Production API Endpoints for the Global Accelerator Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
The researchers discovered that there are 8 non-production endpoints for the Global Accelerator service which can be used with standard IAM credentials and do not log to CloudTrail. This allows for silent permission enumeration, where an adversary can determine the permissions of compromised...
X.Org: Xwayland: Use-after-free of the root cursor
A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free...
X.Org: Xwayland: Use-after-free of the root cursor
A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free...
Magecart: How Akamai Protected a Global Retailer Against a Live Attack
...
Cross-site Scripting
Stage.js is vulnerable to Cross-site Scripting. The vulnerability is due to improper handling of the global DOM namespace, allowing attacker-injected HTML elements to shadow the document.currentScript lookup and unintended element properties to override JavaScript variables...