1434 matches found
CVE-2023-48655
An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parameters...
PT-2023-30876
Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.176 Description An issue was discovered where the app/Controller/Component/IndexFilterComponent.php file does not properly filter out query parameters. Recommendations For versions prior to 2.4.176, update to version...
CVE-2023-45201
Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the admin.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL...
Devolutions Server Security Vulnerability
Devolutions Server is an application from Devolutions Canada. It provides a full-featured shared account and password management solution. A security vulnerability exists in Devolutions Server version 2023.2.10.0 and earlier, which stems from an improper access control issue in the Report log...
Password Disclsosure
nautobot is vulnerable to Password Disclosure. The vulnerability is due to the fact that the utils.py does not correctly inherit all the necessary Meta attributes from the base serializer. This flaw permits an authenticated attacker to access hashed user passwords stored in the database through...
Nautobot Security Vulnerability
Nautobot is a web automation platform from the individual developers of Nautobot. A security vulnerability exists in versions of Nautobot prior to 2.0.3 that stems from certain REST API endpoints that, in combination with a query parameter, can expose hashed user passwords stored in a database to...
CVE-2023-46128: Exposure of Sensitive Information to an Unauthorized Actor
Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 2.0.x, certain REST API endpoints, in combination with the ?depth= query parameter, can expose hashed user passwords as stored in the database to...
PT-2023-7024 · Nautobot · Nautobot
Name of the Vulnerable Software and Affected Versions: Nautobot versions 2.0.0 through 2.0.2 Description: The issue concerns the exposure of hashed user passwords in Nautobot's REST API endpoints when the ?depth= query parameter is used. This affects any authenticated user with access to these...
GHSA-X4HH-VJM7-G2JV Faktory Web Dashboard can lead to denial of service(DOS) via malicious user input
Summary Faktory web dashboard can suffer from denial of service by a crafted malicious url query param days. Details The vulnerability is related to how the backend reads the days URL query parameter in the Faktory web dashboard. The value is used directly without any checks to create a string...
Sql injection
Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a crafted malicious url query param days. The vulnerability is related to how the backend reads the days URL query parameter in the Faktory web...
CVE-2023-37279 Faktory Web Dashboard can lead to denial of service(DOS) via malicious user input
Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a crafted malicious url query param days. The vulnerability is related to how the backend reads the days URL query parameter in the Faktory web...
CVE-2023-37279
Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a crafted malicious url query param days. The vulnerability is related to how the backend reads the days URL query parameter in the Faktory web...
CVE-2023-37279: Allocation of Resources Without Limits or Throttling
Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a crafted malicious url query param days. The vulnerability is related to how the backend reads the days URL query parameter in the Faktory web...
CVE-2023-23957
An authenticated user can see and modify the value for ‘next’ query parameter in Symantec Identity Portal 14.4...
CVE-2023-23957 Open Redirection Vulnerability in Symantec Identity Portal 14.4
An authenticated user can see and modify the value for ‘next’ query parameter in Symantec Identity Portal 14.4...
CVE-2023-23957
CVE-2023-23957 affects Symantec Identity Portal 14.4. An authenticated user can see and modify the value of the ‘next’ query parameter, which corresponds to an open redirection vulnerability in Symantec Identity Portal 14.4. The available documents state the impact as an ability to view/modify th...
CVE-2023-23957 Open Redirection Vulnerability in Symantec Identity Portal 14.4
An authenticated user can see and modify the value for ‘next’ query parameter in Symantec Identity Portal 14.4...
Symantec Identity Portal Input Validation Error Vulnerability
Symantec Identity Portal is an identity and access management from Symantec USA. A security vulnerability exists in Symantec Identity Portal version 14.4. An attacker could view and modify the value of the "next" query parameter...
PT-2023-19323
Name of the Vulnerable Software and Affected Versions Symantec Identity Portal version 14.4 Description An authenticated user can see and modify the value for the next query parameter. Recommendations For Symantec Identity Portal version 14.4, consider restricting access to the next query paramet...