290 matches found
Open Redirect
undici is vulnerable to open redirect. The vulnerability exists due to the insufficient checks in shouldRemoveHeader function, which results in accidental leakage of cookie headers, allowing an attacker to redirect the victim to an attacker controlled site...
Multiple auction can run on same vault - Collateral loss
Lines of code Vulnerability details Impact Due to insufficient checks, it is possible to run 2 auctions at same time. This can lead to loss of collateral for this vault as collateral quantity placed for auction will double Proof of Concept 1. User starts auction on vault id 1 which transfer...
Regular Expression Denial Of Service (ReDoS)
scaffold-helper is vulnerable to regular expression denial of service ReDoS attacks. A remote attacker is able to trigger denial of service conditions due to insufficient checks in getProcessedPath or getDynamicFilename functions. The vulnerability is exploited via copying crafted invalid files...
CVE-2022-31803
In CODESYS Gateway Server V2 an insufficient check for the activity of TCP client connections allows an unauthenticated attacker to consume all available TCP connections and prevent legitimate users or clients from establishing a new connection to the CODESYS Gateway Server V2. Existing connectio...
CVE-2022-1824
McAfee Consumer Product Removal Tool (MCPR) versions prior to 10.4.128 are affected by an uncontrolled search path vulnerability that enables a local user to perform a sideloading attack via a specific filename, potentially gaining elevated privileges and executing arbitrary code due to insuffici...
CVE-2022-1824 McAfee MCPR privilege escalation
An uncontrolled search path vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local attacker to perform a sideloading attack by using a specific file name. This could result in the user gaining elevated permissions and being able to execute arbitrary co...
CVE-2021-26376
Insufficient checks in System Management Unit SMU FeatureConfig may result in reenabling features potentially resulting in denial of resources and/or denial of service...
Mageia: Security Advisory (MGASA-2019-0241)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Mageia: Security Advisory (MGASA-2021-0190)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
OpenJDK: Insufficient URI checks in the XSLT TransformerImpl (JAXP, 8270492)
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows...
Cross-site Scripting (XSS)
getgrav/grav is vulnerable to cross-site scripting XSS attacks. Insufficient checks in detectXss allow remote attackers to inject and execute arbitrary javascript code in the victim's browser...
CVE-2022-0334
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability...
RHEL 7 : java-11-openjdk (RHSA-2022:0204)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0204 advisory. The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fixe...
Exploit for Command Injection in Tp-Link Tapo_C200_Firmware
CVE-2021-4045 CVE-2021-4045 is a Command Injection vulnerabil...
webkitgtk: Insufficient checks leading to arbitrary code execution
This issue was addressed with improved checks. This issue is fixed in iOS 14.7, Safari 14.1.2, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7. Processing maliciously crafted web content may lead to code execution...
CVE-2021-37547
In JetBrains TeamCity before 2020.2.4, insufficient checks during file uploading were made...
GHSA-5V95-V8C8-3RH6 Privilege escalation in rbac
Impact Using a carefully crafted request or malicious proxy, a user with UserWrite permissions could create another user with higher privileges than their own due to insufficient checks on the allowed set of permissions. The event would be captured in the Event Log. Patches The issue has been fix...
PYSEC-2021-245
TensorFlow is an end-to-end open source platform for machine learning. Due to lack of validation in tf.rawops.RaggedTensorToTensor, an attacker can exploit an undefined behavior if input arguments are empty. The...