Cross site request forgery (csrf)

A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. This vulnerability is due to insufficient CSRF protections for th...

CVE-2024-20255

A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. This vulnerability is due to insufficient CSRF protections for th...

CVE-2024-20255

A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. This vulnerability is due to insufficient CSRF protections for th...

The vulnerability in the web interface of the Cisco Prime Infrastructure monitoring and management system, as well as the Cisco Evolved Programmable Network (EPN) Manager software, allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability in the web interface of the Cisco Prime Infrastructure monitoring and management system, as well as the Cisco Evolved Programmable Network EPN Manager software, exists due to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a...

Server side request forgery (ssrf)

Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the SSRFPROTECTIONENABLED environment variable can be bypassed to access...

Italian Data Protection Watchdog Accuses ChatGPT of Privacy Violations

Italy's data protection authority DPA has notified ChatGPT-maker OpenAI of supposedly violating privacy laws in the region. "The available evidence pointed to the existence of breaches of the provisions contained in the E.U. GDPR General Data Protection Regulation," the Garante per la protezione...

The vulnerability in the web interface for managing the Cisco Unity Connection integrated messaging system allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability of the web interface for managing the Cisco Unity Connection integrated messaging system is related to the lack of protective measures taken for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

rpm: TOCTOU race in checks for unsafe symlinks

A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and...

The vulnerability of the Centralized Third-party JAR component (AntiSamy) in the Oracle WebLogic Server application server of the Oracle Fusion Middleware software platform allows a attacker to perform cross-site scripting attacks.

The vulnerability of the Centralized Third-party JAR component AntiSamy in the Oracle WebLogic Server application server of the Oracle Fusion Middleware software platform is related to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a remote attack...

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow lies in the lack of protective measures for the website structure. This allows attackers to circumvent the restrictions on JavaScript execution.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow is related to the lack of protective measures taken for the website structure. Exploiting this vulnerability allows a malicious actor to circumvent restrictions on the execution o...

PAX PoS Terminal Flaw Could Allow Attackers to Tamper with Transactions

The point-of-sale PoS terminals from PAX Technology are impacted by a collection of high-severity vulnerabilities that can be weaponized by threat actors to execute arbitrary code. The STM Cyber R&D team, which reverse engineered the Android-based devices manufactured by the Chinese firm owing to...

The Sad Truth of the FTC's Location Data Privacy Settlement

The FTC forced a data broker to stop selling “sensitive location data.” But most companies can avoid such scrutiny by doing the bare minimum, exposing the lack of protections Americans truly have...

PT-2024-14102 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions 3.8.12 through 3.11.2 Description: The issue allows a malicious website to perform Cross-site Scripting in the tag name pattern field in the tag protections UI, requiring user interaction. Recommendations: Fo...

SUSE-SU-2024:0076-1 Security update for hawk2

This update for hawk2 fixes the following issues: - Fixed HttpOnly secure flag by default bsc1216508. - Fixed CSRF in errorscontroller.rb protection bsc1216571. Update to version 2.6.4+git.1702030539.5fb7d91b: - Fix mime type issue in MS windows bsc1215438 - Parametrize CORS...

The vulnerability of Adobe Experience Manager’s content and media data management system, related to the lack of measures taken to protect the website structure, allows attackers to carry out XSS attacks.

The vulnerability of the Adobe Experience Manager content and media data management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to carry out XSS attacks...

ALPINE-CVE-2023-46836

The fixes for XSA-422 Branch Type Confusion and XSA-434 Speculative Return Stack Overflow are not IRQ-safe. It was believed that the mitigations always operated in contexts with IRQs disabled. However, the original XSA-254 fix for Meltdown XPTI deliberately left interrupts enabled on two entry...

CVE-2023-46836

The fixes for XSA-422 Branch Type Confusion and XSA-434 Speculative Return Stack Overflow are not IRQ-safe. It was believed that the mitigations always operated in contexts with IRQs disabled. However, the original XSA-254 fix for Meltdown XPTI deliberately left interrupts enabled on two entry...

CVE-2023-46836

The fixes for XSA-422 Branch Type Confusion and XSA-434 Speculative Return Stack Overflow are not IRQ-safe. It was believed that the mitigations always operated in contexts with IRQs disabled. However, the original XSA-254 fix for Meltdown XPTI deliberately left interrupts enabled on two entry...

The vulnerability of the APDU Frame Layout Handler component in Hitachi Energy RTU500 CMU series programmable logic controllers allows a attacker to trigger a service failure.

The vulnerability of the APDU Frame Layout Handler component in Hitachi Energy RTU500 CMU series programmable logic controllers is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to trigger service failures by sending...

The vulnerability of Adobe Experience Manager’s content and media data management system, related to the lack of measures taken to protect the website structure, allows attackers to carry out XSS attacks.

The vulnerability of the Adobe Experience Manager content and media data management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to carry out XSS attacks...