882 matches found
CVE-2023-36844 Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment...
CVE-2023-36847 Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication an...
CVE-2023-36844
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables...
CVE-2023-4380
A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows an attacker to retrieve the credentials from the log, resulting in the loss of confidentiality, integrity, and availability...
The vulnerability of the phpMyFAQ web application lies in the absence of a mechanism to neutralize certain elements. This allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.
The vulnerability of the phpMyFAQ web application is related to the absence of element neutralization mechanisms. Exploiting this vulnerability allows a remote attacker to gain access to confidential data, compromise its integrity, and cause service failures using a specially crafted CSV file...
The vulnerability of the ezxml_new function in the XML document syntax analysis library ezXML allows a attacker to compromise data integrity and cause service failures.
The vulnerability of the ezxmlnew function in the XML document syntax analysis library ezXML is related to buffer overflow attacks. Exploiting this vulnerability allows an attacker to compromise data integrity and cause service failures...
The vulnerability of the os_unix.c component of the SQLite database management system allows a attacker to access confidential data, compromise its integrity, and cause service failures.
The vulnerability of the osunix.c component of the SQLite database management system is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to access confidential data, compromise its integrity, and cause service failures...
The vulnerability of the Runc command-line tool for isolated containers arises from incorrect handling of symbolic links before accessing the file. This allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.
The vulnerability of the Runc container launch tool is related to incorrect handling of symbolic links before accessing the file. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures...
The vulnerability of the SmmEntryPoint function in open-source development environments for UEFI EDK2 allows attackers to access confidential data, compromise its integrity, and cause service failures.
The vulnerability of the SmmEntryPoint function in open-source development environments for UEFI EDK2 relates to writing beyond the buffer boundaries. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures...
The vulnerability in the Firefox web browser relates to the insufficient elimination of certain elements in the request, which allows a malicious actor to access confidential data, compromise its integrity, and cause service failures.
The vulnerability in the Firefox web browser is related to insufficient elimination of certain elements in the request. Exploiting this vulnerability allows a remote attacker to gain access to confidential data, compromise its integrity, and cause service failures...
Design/Logic Flaw
SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass the victim’s old password via brute force, due to unrestricted rate limit for password change functionality. Although the attack has no impa...
CVE-2023-36917 Password Change rate limit bypass in SAP BusinessObjects Business Intelligence Platform
SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass the victim’s old password via brute force, due to unrestricted rate limit for password change functionality. Although the attack has no impa...
The vulnerability of Django’s software platform’s `forms.FileField` and `forms.ImageField` components allows attackers to access sensitive data, compromise its integrity, and cause service failures.
The vulnerability of the forms.FileField and forms.ImageField components in the Django web application framework is related to insufficient validation of entered data. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service...
CVE-2023-34472
AMI SPx contains a vulnerability in the BMC where an Attacker may cause an improper neutralization of CRLF sequences in HTTP Headers. A successful exploit of this vulnerability may lead to a loss of integrity...
AMI MegaRAC 信任管理问题漏洞
AMI MegaRAC is a family of service processor products from AMI. Complete out-of-band or unlit remote management of computer systems independent of operating system state or location is available to troubleshoot computers and ensure service continuity. A security vulnerability exists in AMI MegaRA...
PT-2023-24823 · Ami · Ami Spx
Name of the Vulnerable Software and Affected Versions: AMI SPx affected versions not specified Description: The issue is related to a hard-coded cryptographic key used by a hard-coded certificate in the BMC of AMI SPx. This could lead to a loss of confidentiality, integrity, and availability if...
CVE-2023-25518
NVIDIA Jetson contains a vulnerability in CBoot, where the PCIe controller is initialized without IOMMU, which may allow an attacker with physical access to the target device to read and write to arbitrary memory. A successful exploit of this vulnerability may lead to code execution, denial of...
NVIDIA Jetson 安全漏洞
NVIDIA Jetson is an embedded system development module from NVIDIA. NVIDIA Jetson suffers from a security vulnerability that originates from the initialization of the PCIe controller without an IOMMU, which can be exploited by an attacker to read and write arbitrary memory, and successful...
Race condition
SUBNET PowerSYSTEM Center versions 2020 U10 and prior are vulnerable to replay attacks which may result in a denial-of-service condition or a loss of data integrity...
CVE-2023-29158 SUBNET PowerSYSTEM Center Authentication Bypass by Capture-replay
SUBNET PowerSYSTEM Center versions 2020 U10 and prior are vulnerable to replay attacks which may result in a denial-of-service condition or a loss of data integrity...