2715 matches found
CVE-2023-35851 SUNNET WMPro - SQL Injection
SUNNET WMPro portal's FAQ function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to obtain sensitive information via a database...
ROS-20230913-03
A vulnerability in libreswan software is related to a null pointer dereferencing error in the IKEv1 fast mode packets. Exploitation of the vulnerability could allow an attacker, remotely send specially crafted packets to the system and perform a denial-of-service attack. denial-of-service attack...
The vulnerability of the Symfony software platform for developing and managing web applications lies in the insufficient validation of the authenticity of executed requests, allowing attackers to carry out CSRF attacks.
The vulnerability of the Symfony software platform for developing and managing web applications is related to insufficient validation of the authenticity of executed requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack remotely...
CVE-2023-39286
A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an unauthenticated attacker to perform a Cross Site Request Forgery CSRF attack due to insufficient request validation. A successful exploit could allow an attacker to provide a...
CVE-2023-4915
The WP User Control plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.5.3. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function in the WP User Control Widget. The functi...
ROS-20230911-07
A vulnerability in the Moodle virtual learning environment is related to insufficient validation of user input data. data, an attacker could send a specially crafted HTTP request and make the application initiate requests to arbitrary systems. Exploitation of the vulnerability could allow an...
CVE-2023-3747 Insufficient Validation on Override Codes for Always-Enabled WARP Mode
Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created by the Administrators to allow a device to temporarily be disconnected from WARP, however, due to lack of server side validation, an attacker with local access...
CVE-2023-3747 Insufficient Validation on Override Codes for Always-Enabled WARP Mode
Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created by the Administrators to allow a device to temporarily be disconnected from WARP, however, due to lack of server side validation, an attacker with local access...
PT-2023-36421 · Undefined · Undefined
Уязвимость метода CreateAttachmentFromUri почтового сервера Microsoft Exchange Server связана с недостаточной проверкой поступающих запросов. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, раскрыть защищаемую информацию...
The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow lies in the insufficient checking of incoming requests. This allows attackers to disclose sensitive information or cause service failures.
The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow is related to insufficient validation of incoming requests. Exploiting this vulnerability can allow a malicious actor to expose sensitive information or cause service failures by...
The vulnerability of the Request package on the Node.js software platform allows a attacker to perform an SSRF attack.
The vulnerability of the Request package in the Node.js software platform is related to insufficient validation of incoming requests. Exploiting this vulnerability allows a remote attacker to execute an SSRF attack...
Relative path traversal
Description The endpoint /system/data-exports/:filename is intended to export AnythingLLM data zip file for download based on a specified filename parameter. However, a critical security vulnerability arises due to insufficient validation and sanitization of the request.params.filename parameter...
PT-2023-5907
Name of the Vulnerable Software and Affected Versions Gevent versions prior to 23.9.1 Gevent version 23.9.0 Description The issue in Gevent is related to insufficient validation of executed requests in the WSGIServer component, allowing a remote attacker to escalate privileges via a crafted scrip...
Debian dla-3545 : python3-flask-security - security update
The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3545 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3545-1 [email protected] https://www.debian.org/lts/security/...
Sql injection
Online Shopping Portal Project 3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in the username field, enabling...
Stored XSS
Description Due to insufficient validation of uploaded files - bad actors can upload malicious SVG file with XSS payload. That leads to Stored XSS. Because accessToken cookie has valid HttpOnly flag, can not take victims cookie there in this way, but please keep in mind that XSS in general is abo...
RubyGems 输入验证错误漏洞
RubyGems is a Ruby package manager from the RubyGems organization. The product is primarily used to distribute and manage Ruby packages. RubyGems suffers from an input validation error vulnerability that stems from insufficient input validation and allows malicious actors to replace files...
Cross site scripting
A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager EPNM could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface on an affected device. The...
The vulnerability of the modVulnerabilityProtect widget in the monitoring and security management panel of Trend Micro Apex Central allows a attacker to perform an SSRF attack.
The vulnerability of the modVulnerabilityProtect widget in the monitoring and security management panel of Trend Micro Apex Central is related to insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack remotely...
CVE-2023-20564
Insufficient validation in the IOCTL Input Output Control input buffer in AMD Ryzen™ Master may permit a privileged attacker to perform memory reads/writes potentially leading to a loss of confidentiality or arbitrary kernel execution...