6431 matches found
Insecure Direct Object Reference (IDOR)
aimeos/ai-controller-frontend is vulnerable to Insecure Direct Object Reference IDOR. The vulnerability is due to a lack of proper access control and authorization checks, allowing attackers to manipulate object references like user IDs without verification...
Spoofing Attack
mellium.im/xmpp is vulnerable to Spoofing Attack. The vulnerability is due to the implementation of the Mellium XMPP library, which does not check the stanza type and allows the use of predictable IDs, leading to the possibility of response spoofing...
CVE-2024-46957: Authentication Bypass by Spoofing
Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing if the implementation uses predictable IDs because the stanza type is not checked. This is fixed in 0.22.0...
About the security content of visionOS2
About the security content of visionOS2 This document describes the security content of visionOS 2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...
About the security content of iOS 17.7 and iPadOS 17.7
About the security content of iOS 17.7 and iPadOS 17.7 This document describes the security content of iOS 17.7 and iPadOS 17.7. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches ...
About the security content of iOS 18 and iPadOS 18
About the security content of iOS 18 and iPadOS 18 This document describes the security content of iOS 18 and iPadOS 18. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...
About the security content of macOS Ventura 13.7
About the security content of macOS Ventura 13.7 This document describes the security content of macOS Ventura 13.7. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases...
wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authenticati...
CVE-2024-45311 Denial of service in quinn-proto when using `Endpoint::retry()`
Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. As of quinn-proto 0.11, it is possible for a server to accept, retry, refuse, or ignore an Incoming connection. However, calling retry on an unvalidated connection exposes the server to a likely panic in th...
Hashtable Collisions
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Hashtable Collisions', 'Description' = %q This module uses a denial-of-service DoS condition appearing in a variety of programming languages. Thi...
Microsoft SQL Server SUSER_SNAME SQL Logins Enumeration
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft SQL Server SUSERSNAME SQL Logins Enumeration', 'Description' = %q This module can be used to obtain a list of all logins from a SQL...
CVE-2024-8319
The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.20. This is due to missing or incorrect nonce validation on the tforderstatusemailresendfunction, tfvisitordetailseditfunction, tfcheckinoutdetailseditfunction,...
Out-Of-Bounds Writes
TensorFlow is vulnerable to out-of-bounds writes. The vulnerability is due to the improper handling of negative elements in the segment ids tensor, allowing negative values that result in out-of-bounds memory writes during the segment sum operation...
Security Bulletin: NVIDIA CUDA Toolkit - August 2024
NVIDIA has released a software update for NVIDIA® CUDA® Toolkit. To protect your system, download and install this software update from the CUDA Toolkit Downloads page. Go to NVIDIA Product Security. Details This section provides a summary of potential vulnerabilities that this security update...
PT-2024-30448
Name of the Vulnerable Software and Affected Versions Contest Gallery versions prior to 23.1.3 Description The issue is related to the exposure of sensitive information to an unauthorized actor. This affects the Contest Gallery plugin for WordPress, potentially disclosing unauthorized comment use...
CVE-2024-43477: Improper Access Control
Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on another tenant...
Microsoft Entra ID Elevation of Privilege Vulnerability
Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on another tenant...
UBUNTU-CVE-2022-48929
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix crash due to out of bounds access into reg2btfids. When commit e6ac2450d6de "bpf: Support bpf program calling kernel function" added kfunc support, it defined reg2btfids as a cheap way to translate the verifier reg type ...
Virtuozzo Hybrid Infrastructure 6.2 Update 1 (6.2.1-51)
In this release, Virtuozzo Hybrid Infrastructure provides stability and performance improvements, as well as addresses issues found in previous releases. Vulnerability id: VSTOR-68405 Failed to deploy the compute cluster due to an issue with the default storage policy. Vulnerability id: VSTOR-880...
PT-2024-30590 · Unknown · Decentralized Identity Services
Name of the Vulnerable Software and Affected Versions: Decentralized Identity Services affected versions not specified Description: The issue is related to improper access control in Decentralized Identity Services, allowing an unauthenticated attacker to disable Verifiable ID's on another tenant...