Lucene search
+L

2329 matches found

The Hacker News
The Hacker News
added 2019/11/06 9:08 a.m.8 views

Explained: How New 'Delegated Credentials' Boosts TLS Protocol Security

Mozilla, in partnership with Facebook, Cloudflare, and other IETF community members, has announced technical specifications for a new cryptographic protocol called "Delegated Credentials for TLS." Delegated Credentials for TLS is a new simplified way to implement "short-lived" certificates withou...

5.8AI score
SaveExploits0
OSV
OSV
added 2019/11/06 12:15 a.m.9 views

CVE-2019-8227

In Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code via import / export functionality when creating profile action XML...

4.8CVSS6AI score0.00517EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2019/11/06 12:00 a.m.31 views

CVE-2019-8227

In Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code via import / export functionality when creating profile action XML...

5.2AI score0.00517EPSS
SaveExploits0References1
UbuntuCve
UbuntuCve
added 2019/11/01 12:00 a.m.39 views

CVE-2019-8625

A logic issue was addressed with improved state management. This issue is fixed in tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web content may lead to universal cross site scripting...

6.1CVSS5.8AI score0.0122EPSS
SaveExploits0References3
NVD
NVD
added 2019/10/24 4:15 p.m.22 views

CVE-2019-15929

In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...

9.8CVSS9.5AI score0.01753EPSS
SaveExploits1References2
OSV
OSV
added 2019/10/24 4:15 p.m.17 views

CVE-2019-15929

In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...

9.8CVSS7.2AI score
SaveExploits0References2
Cvelist
Cvelist
added 2019/10/24 3:53 p.m.35 views

CVE-2019-15929

In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...

9.6AI score0.01753EPSS
SaveExploits1References2
Hacker One
Hacker One
added 2019/10/11 1:25 p.m.56 views

Mail.ru: SSRF in clients.city-mobil.ru

Limited non-blind SSRF in clients.city-mobil.ru the report was submitted before the launch of dedicated bug bounty scope for Citymobil Non-blind SSRF in apt-cacher, used for getting software updates, allowing limited requests to internal services...

2.1AI score
SaveExploits0
Symantec
Symantec
added 2019/10/08 12:00 a.m.36 views

SAP Financial Consolidation Multiple Unspecified Security Vulnerabilities

Description SAP Financial Consolidation is prone to multiple unspecified security vulnerabilities. Limited information is currently available regarding these issues. We will update this BID as more information emerges. SAP Financial Consolidation versions 10.0 and 10.1 are vulnerable. Technologie...

1.3AI score
SaveExploits0References1Affected Software1
OSV
OSV
added 2019/09/30 7:42 p.m.28 views

GHSA-CXW4-9QV9-VX5H High severity vulnerability that affects PeterO.Cbor

Impact The CBOR library supports optional tags that enable CBOR objects to contain references to objects within them. Versions earlier than 4.0 resolved those references automatically. While this by itself doesn't cause much of a security problem, a denial of service can happen if those reference...

7.5AI score
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2019/09/30 7:42 p.m.37 views

High severity vulnerability that affects PeterO.Cbor

Impact The CBOR library supports optional tags that enable CBOR objects to contain references to objects within them. Versions earlier than 4.0 resolved those references automatically. While this by itself doesn't cause much of a security problem, a denial of service can happen if those reference...

0.1AI score
SaveExploits0References2Affected Software1
OSV
OSV
added 2019/09/27 7:15 p.m.7 views

CVE-2019-9280

In keyguard, there is a possible escalation of privilege due to improper permission checks. This could lead to a local bypass of the keyguard under limited circumstances, with User execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions:...

3.3CVSS6.4AI score0.00147EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2019/09/27 6:05 p.m.29 views

CVE-2019-9351

In SyncStatusObserver, there is a possible bypass for operating system protections that isolate user profiles from each other due to a missing permission check. This could lead to local limited information disclosure with no additional execution privileges needed. User interaction is not needed f...

4.6AI score0.00138EPSS
SaveExploits0References1
OSV
OSV
added 2019/09/26 12:15 p.m.21 views

CVE-2019-12617

In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution...

2.7CVSS7.1AI score
SaveExploits0References4
NVD
NVD
added 2019/09/26 12:15 p.m.23 views

CVE-2019-12617

In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution...

4CVSS4AI score0.00855EPSS
SaveExploits0References4
Prion
Prion
added 2019/09/26 12:15 p.m.16 views

Design/Logic Flaw

In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution...

4CVSS4.2AI score0.00855EPSS
SaveExploits0References4Affected Software1
NVD
NVD
added 2019/09/14 6:15 p.m.31 views

CVE-2019-16317

In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var/assets/ directory, a different...

8.8CVSS8.6AI score0.01698EPSS
SaveExploits0References2
OSV
OSV
added 2019/09/14 6:15 p.m.34 views

CVE-2019-16318

In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2019-10867 and CVE-2019-16317...

8.8CVSS8.6AI score
SaveExploits0References2
Prion
Prion
added 2019/09/14 6:15 p.m.29 views

Directory traversal

In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var/assets/ directory, a different...

6.5CVSS8.6AI score0.68874EPSS
SaveExploits5References2Affected Software1
NVD
NVD
added 2019/09/11 8:15 p.m.31 views

CVE-2019-3759

The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a code injection vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to run custom Groovy scripts to gain limited access to vie...

8.1CVSS7AI score0.03226EPSS
SaveExploits3References2
Rows per page
Query Builder