Improper one time password handling in devise-two-factor

Impact As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password OTP for one and only one immediately trailing interval. Patches This vulnerability has been patched in version 4.0.2 which was released on March...

Improper one time password handling in devise-two-factor

Impact As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password OTP for one and only one immediately trailing interval. Patches This vulnerability has been patched in version 4.0.2 which was released on March...

Input validation

An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. There is Improper Handling of Case Sensitivity, which makes password guessing easier...

CVE-2021-45893

The CVE-2021-45893 entry applies to Softwarebuero Zauner ARC version 4.2.0.4. Connected documents confirm an input validation error caused by improper case sensitivity handling, which can make password guessing easier. Descriptions across sources (NVD, Red Hat, CNVD, PRION, CVE list) consistently...

The vulnerability of the command line interface of fish, related to deficiencies in the process of neutralizing special elements in the output data, allows a hacker to execute arbitrary code.

The vulnerability of the fish command-line interface is related to deficiencies in the process of neutralizing special elements in the output data. Exploiting this vulnerability allows an attacker to execute arbitrary code...

CVE-2021-35115

Improper handling of multiple session supported by PVM backend can lead to use after free in Snapdragon Auto, Snapdragon Mobile...

CVE-2021-35115

Improper handling of multiple session supported by PVM backend can lead to use after free in Snapdragon Auto, Snapdragon Mobile...

CVE-2021-35115

CVE-2021-35115 involves an improper handling of multiple sessions in the PVM backend of Qualcomm Snapdragon devices (Auto and Mobile), leading to a use-after-free condition. Affected components are the PVM backend/session management logic in Snapdragon SoCs (e.g., Snapdragon Auto, Snapdragon Mobi...

[WP-H11] lender may not be able to get back their funds, due to improper handling of potential loss of strategy

Lines of code Vulnerability details uint256 notBorrowed = pooledCLConstantsid.borrowLimit.subPOOLEDCREDITLINE.getPrincipalid; uint256 notBorrowedInShares = IYieldstrategy.getSharesForTokensnotBorrowed, borrowAsset; uint256 sharesHeld = pooledCLVariablesid.sharesHeld; requiresharesHeld != 0,...

The vulnerability of the Magento Commerce software platform for developing and managing online stores stems from improper handling of logical operations, allowing attackers to circumvent existing security restrictions.

The vulnerability of the Magento Commerce software platform for developing and managing online stores is related to the improper handling of logical operations. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions remotely...

Path Traversal

studio-42/elfinder is vulnerable to path traversal. The vulnerability exists due to improper handling of absolute file paths in the getFullPathfunction. allowing a remote attacker to access data in the system...

Microsoft Windows Transaction Manager Privilege Escalation Vulnerability

A privilege escalation vulnerability exists when the Windows Transaction Manager improperly handles objects in memory...

NVIDIA Linux GPU Display Driver (February 2022)

The NVIDIA GPU display driver software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities: - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver, where improper handling of insufficient permissions or privileges ma...

Siemens SIMOTICS CONNECT 400

1. EXECUTIVE SUMMARY CVSS v3 8.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SIMOTICS CONNECT 400 Vulnerabilities: Type Confusion, Improper Validation of Specified Quantity in Input, Wrap or Wraparound, Improper Handling of Inconsistent Structural Elements 2...

CVE-2022-21158

A stored cross-site scripting vulnerability in marktext versions prior to v0.17.0 due to improper handling of the link with javascript: scheme inside the document may allow an attacker to execute an arbitrary script on the PC of the user using marktext...

CVE-2022-21158

A stored cross-site scripting vulnerability in marktext versions prior to v0.17.0 due to improper handling of the link with javascript: scheme inside the document may allow an attacker to execute an arbitrary script on the PC of the user using marktext...

CVE-2022-25595

ASUS RT-AC86U has improper user request handling, which allows an unauthenticated LAN attacker to cause a denial of service by sending particular request a server-to-client reply attempt...

Design/Logic Flaw

A vulnerability in the Cisco Discovery Protocol service of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause the service to restart, resulting in a denial of service DoS condition. This vulnerability is due to improper handling of Cisco...

Design/Logic Flaw

MobiSoft - MobiPlus User Take Over and Improper Handling of url Parameters Attacker can navigate to specific url which will expose all the users and password in clear text. http://IP/MobiPlusWeb/Handlers/MainHandler.ashx?MethodName=GridData&GridName=Users...

CVE-2022-22792 MobiSoft - MobiPlus User Take Over and Improper Handling of url Parameters

MobiSoft - MobiPlus User Take Over and Improper Handling of url Parameters Attacker can navigate to specific url which will expose all the users and password in clear text. http://IP/MobiPlusWeb/Handlers/MainHandler.ashx?MethodName=GridData&GridName=Users...