2236 matches found
CVE-2024-22023
An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS...
BIT-AIRFLOW-2024-28746 Apache Airflow: Ignored Airflow Permissions
Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access. Users of Apache Airflow are recommended to upgrade to...
CVE-2023-42950
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 17.2, iOS 17.2 and iPadOS 17.2, tvOS 17.2, watchOS 10.2, macOS Sonoma 14.2. Processing maliciously crafted web content may lead to arbitrary code execution...
CVE-2024-42950
Notes Author| Note ---|--- jdstrand | webkit receives limited support. For details, see https://wiki.ubuntu.com/SecurityTeam/FAQwebkit webkit in Ubuntu uses the JavaScriptCore JSC engine, not V8 mdeslaur | It is no longer possible to build new webkit2gtk versions on focal and earlier. Marking as...
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
Ivanti Endpoint Manager Cloud Service Appliance EPM CSA contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions nobody...
CVE-2024-28029
Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality...
CVE-2024-28029 Client-Side Enforcement of Server-Side Security in Delta Electronics DIAEnergie
Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality...
[SECURITY] Fedora 38 Update: libuev-2.4.1-1.fc38
libuEv is a small event loop that wraps the Linux epoll family of APIs. It is similar to the more established libevent, libev and the venerable Xt3 event loop. The =EF=BF=BD=EF=BF=BD in the name refers to both its limited feature set and the size impact of the library...
[SECURITY] Fedora 39 Update: libuev-2.4.1-1.fc39
libuEv is a small event loop that wraps the Linux epoll family of APIs. It is similar to the more established libevent, libev and the venerable Xt3 event loop. The =EF=BF=BD=EF=BF=BD in the name refers to both its limited feature set and the size impact of the library...
PT-2024-22223 · Delta Electronics +1 · Diaenergie
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue arises from incomplete server-side verification of privileges, allowing users with limited privileges to bypass authorization and access...
Discourse Denial of Service Vulnerability (CNVD-2024-14304)
Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. Discourse suffers from a denial of service vulnerability that stems from the POST /uploads endpoint not being rate-limited. An attacker could exploit this vulnerabili...
Sensitive Information Disclosure
Mattermost-plugin-playbooks is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper authorization checks when creating a playbook action. An attacker with limited privileges can leak sensitive playbook information, such as the playbook's name, by creating a playboo...
GHSA-4946-85PR-FVXH vantage6's CORS settings overly permissive
Impact The vantage6 server has no restrictions on CORS settings. It should be possible for people to set the allowed origins of the server. The impact is limited because v6 does not use session cookies Patches No Workarounds No...
vantage6's CORS settings overly permissive
Impact The vantage6 server has no restrictions on CORS settings. It should be possible for people to set the allowed origins of the server. The impact is limited because v6 does not use session cookies Patches No Workarounds No...
Whoogle Search Path Traversal vulnerability
Whoogle Search is a self-hosted metasearch engine. Versions 0.8.3 and prior have a limited file write vulnerability when the configuration options in Whoogle are enabled. The config function in app/routes.py does not validate the user-controlled name variable on line 447 and configdata variable o...
GHSA-HH2Q-QV66-JCQG Whoogle Search Path Traversal vulnerability
Whoogle Search is a self-hosted metasearch engine. Versions 0.8.3 and prior have a limited file write vulnerability when the configuration options in Whoogle are enabled. The config function in app/routes.py does not validate the user-controlled name variable on line 447 and configdata variable o...
Incorrect Authorization
org.apache.pulsar, pulsar-broker is vulnerable to Incorrect Authorization. The vulnerability exists due to inadequate access controls to modify topic-level policies. Only users with the tenant admin or super user role should be permitted to perform such management operations, allowing authenticat...
PYSEC-2024-46
Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access.Users of Apache Airflow are recommended to upgrade to versio...
Design/Logic Flaw
An unauthenticated remote attacker can use an XSS attack due to improper neutralization of input during web page generation. User interaction is required. This leads to a limited impact of confidentiality and integrity but no impact of availability...