CVE-2022-48300

The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality...

CVE-2022-48299

The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality...

Huawei EulerOS: Security Advisory for grub2 (EulerOS-SA-2023-1317)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-48300

The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality...

CVE-2022-48299

CVE-2022-48299 affects Huawei HarmonyOS: the WMS module exposes APIs without proper authentication. Root cause: insufficient authentication in the WMS interface. Impact: potential data confidentiality loss via network access (CVSS 3.1 base score 7.5). Exploitation status is not detailed in the pr...

CVE-2023-0002

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent...

EulerOS 2.0 SP8 : grub2 (EulerOS-SA-2023-1317)

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A buffer overflow was found in grubfontconstructglyph. A malicious crafted pf2 font can lead to an overflow when calculating the maxglyphsize...

CVE-2022-41903

A flaw was found in Git, a distributed revision control system. This issue occurs due to an integer overflow in pretty.c::formatandpadcommit, where a sizet is stored improperly as an int, and then added as an offset to a memcpy. This overflow can be triggered directly by a user running a command...

git: Heap overflow in `git archive`, `git log --format` leading to RCE

A flaw was found in Git, a distributed revision control system. This issue occurs due to an integer overflow in pretty.c::formatandpadcommit, where a sizet is stored improperly as an int, and then added as an offset to a memcpy. This overflow can be triggered directly by a user running a command...

git: Heap overflow in `git archive`, `git log --format` leading to RCE

A flaw was found in Git, a distributed revision control system. This issue occurs due to an integer overflow in pretty.c::formatandpadcommit, where a sizet is stored improperly as an int, and then added as an offset to a memcpy. This overflow can be triggered directly by a user running a command...

CVE-2023-22474

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header x-forwarded-for to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server wi...

CVE-2023-22474 Parse Server is vulnerable to authentication bypass via spoofing

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header x-forwarded-for to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server wi...

The vulnerability of the “Downloads” mechanism in Google Chrome and Microsoft Edge browsers allows a hacker to circumvent security restrictions.

The vulnerability of the “Downloads” mechanism in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass security restrictions through a specially created HTML page...

GHSA-VM5R-C87R-PF6X Parse Server option `masterKeyIps` vulnerability to IP spoofing

Impact Parse Server uses the request header x-forwarded-for to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various feature...

Parse Server option `masterKeyIps` vulnerability to IP spoofing

Impact Parse Server uses the request header x-forwarded-for to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various feature...

CVE-2022-32515

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause brute force attacks to take over the admin account when the product does not implement a rate limit mechanism on the admin authentication form. Affected Products: Conext™ ComBox All Versions...

CVE-2023-0581 PrivateContent <= 8.4.3 - Protection Mechanism Bypass

The PrivateContent plugin for WordPress is vulnerable to protection mechanism bypass due to the use of client side validation in versions up to, and including, 8.4.3. This is due to the plugin checking if an IP had been blocklist via client-side scripts rather than server-side. This makes it...

CVE-2023-0581

CVE-2023-0581 affects the PrivateContent WordPress plugin (up to version 8.4.3). Root cause: login protection relies on client-side validation to determine blocklisted IPs, allowing unauthenticated bypass of login restrictions. Impact is the potential to brute-force login bypass. Mitigation: upda...

CVE-2022-32515

Conext ComBox is affected by CWE-307 due to insufficient restriction of excessive authentication attempts on the admin login form. The vulnerability exists in all versions and could enable brute-force takeover of the admin account when rate limiting is not implemented. The connected sources confi...

Cross-site Request Forgery (CSRF)

cakephp/cakephp is vulnerable to Cross-Site Request Forgery CSRF. A remote attacker is able to bypass the CSRF protection mechanism via the $cookie variable in validateToken function because CsrfComponent fails to invalidate requests that are missing both the CSRF token, and CSRF post data...