CVE-2021-46785

The Property module has a vulnerability in permission control.This vulnerability can be exploited to obtain the unique device identifier...

CVE-2021-46785

CVE-2021-46785 concerns Huawei/HarmonyOS where the Property module contains a permission-control flaw that can be exploited to disclose the device’s unique identifier. Multiple connected sources (CNVD/CNNVD/NVD) describe an authorization/permission-control issue in HarmonyOS’s Property component ...

GHSA-PHF8-3QGV-RG5Q Missing Authorization in Jenkins Blue Ocean Plugin

The optional Run/Artifacts permission can be enabled by setting a Java system property. Blue Ocean did not check this permission before providing access to archived artifacts, Item/Read permission was sufficient. Blue Ocean now correctly checks the Run/Artifacts permission if it’s enabled before...

Improper Input Validation in Apache CXF

Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service DoS attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack...

GHSA-2RVF-329F-P99G System Property Disclosure in Apache Tomcat

When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for...

CVE-2021-46785: Undefined Security Weakness

The Property module has a vulnerability in permission control.This vulnerability can be exploited to obtain the unique device identifier...

PT-2022-12919

Name of the Vulnerable Software and Affected Versions Property module affected versions not specified Description The issue concerns a vulnerability in permission control within the Property module. This vulnerability can be exploited to obtain the unique device identifier. Recommendations At the...

PT-2022-19830

Name of the Vulnerable Software and Affected Versions HiAIserver affected versions not specified Description The issue lies in the verification of properties used in the model, which can be exploited to affect AI services. Recommendations At the moment, there is no information about a newer versi...

HUAWEI HarmonyOS License Issue Vulnerability (CNVD-2022-41788)

HUAWEI HarmonyOS is an operating system from the Chinese company Huawei HUAWEI. It provides a full-scenario distributed operating system based on a microkernel. An authorization issue vulnerability exists in the HUAWEI HarmonyOS kernel, which stems from improper control of permissions in the...

Damon data exchange platform has a logic flaw vulnerability

Ltd. is a general-purpose, platform-based data integration product with independent intellectual property rights based on more than ten years of data processing experience. There is a logic flaw vulnerability in Damon Data Exchange Platform, which can be used by attackers to obtain sensitive...

buyingsingaporeproperty.com Cross Site Scripting vulnerability OBB-2602790

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-1586

An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compilexclassmatchingpath function of the pcre2jitcompile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in...

melbournepropertyexpo.com Cross Site Scripting vulnerability OBB-2599533

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Spring Data Commons < 1.13.11 / 2.x < 2.0.6 RCE

The version of Spring Data Commons installed on the remote host is affected by a remote code execution vulnerability. Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of...

HUAWEI HarmonyOS 安全漏洞

HUAWEI HarmonyOS is an operating system from the Chinese company Huawei HUAWEI. It provides a full-scenario distributed operating system based on a microkernel. An authorization issue vulnerability exists in the HUAWEI HarmonyOS kernel, which stems from improper control of permissions in the...

Chinese Hackers Caught Stealing Intellectual Property from Multinational Companies

An elusive and sophisticated cyberespionage campaign orchestrated by the China-backed Winnti group has managed to fly under the radar since at least 2019. Dubbed "Operation CuckooBees" by Israeli cybersecurity company Cybereason, the massive intellectual property theft operation enabled the threa...

libreoffice:pptfuzzer: Heap-use-after-free in SdrObject::SendUserCall

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=6061132114165760 Project: libreoffice Fuzzing Engine: honggfuzz Fuzz Target: pptfuzzer Job Type: honggfuzzasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash...

Roundup xml-rpc server improper check of property permissions

The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the 1 list, 2 display, and 3 set methods...

jsgui-lang-essentials 安全漏洞

jsgui-lang-essentials is a small but powerful utility module for use with other jsgui modules. A security vulnerability exists in all versions of the jsgui-lang-essentials package, which stems from the fact that it allows all Object properties to be changed...

Adobe Acrobat Reader DC zoomType Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handli...