764 matches found
CVE-2023-28635
vantage6 is privacy preserving federated learning infrastructure. Prior to version 4.0.0, malicious users may try to get access to resources they are not allowed to see, by creating resources with integers as names. One example where this is a risk, is when users define which users are allowed to...
CVE-2023-28635 Defining resource name as integer in vantage6 may give unintended access
vantage6 is privacy preserving federated learning infrastructure. Prior to version 4.0.0, malicious users may try to get access to resources they are not allowed to see, by creating resources with integers as names. One example where this is a risk, is when users define which users are allowed to...
vantage6 Code Issue Vulnerability
vantage6 is vantage6 open source an open source priVAcy preserviNg federalTed leArningG infrastructure for Secure Insight eXchange. A code issue vulnerability exists in versions of vantage6 prior to 3.9 that stems from the fact that a malicious user may attempt to access resources they are not...
Advisory ROSA-SA-2023-2241
Software: kernel 3.10.0 OS: rosa-server79 packageevrstring: kernel-3.10.0-1160.83.1.el7 CVE-ID: CVE-2023-3397 BDU-ID: 2023-03779 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the JFS file system of the Linux operating system kernel is related to the reuse of previously freed memory due to...
apache-ivy: XML External Entity vulnerability
Improper Restriction of XML External Entity Reference, XML Injection aka Blind XPath Injection vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy...
ROS-20230904-01
The vulnerability of the qfqchangeclass function of the Linux kernel is related to the operation exceeding the buffer boundaries in memory while processing the QFQMINLMAX value. buffer boundaries in memory when processing the QFQMINLMAX value. Exploitation of the vulnerability could allow an...
How to store ICA files of Citrix Workspace app for Windows in memory instead of the local disk
When launching a resource, an ICA file is generated containing instructions on how to access the resource. Older versions of Citrix Workspace app for Windows stored this to disk. As the ICA file can contain sensitive information such as the name of the server hosting the resources, it is preferab...
CVE-2022-46751 Apache Ivy: XML External Entity vulnerability in Apache Ivy
Improper Restriction of XML External Entity Reference, XML Injection aka Blind XPath Injection vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy...
The vulnerability of the software environment of Siemens Tecnomatix Plant Simulation, related to access to resources through incompatible types, allows a perpetrator to execute arbitrary code.
The vulnerability of the software environment for simulation modeling of systems and processes in Siemens Tecnomatix Plant Simulation lies in the inability to access resources when dealing with incompatible types of STP files. Exploiting this vulnerability can allow attackers to execute arbitrary...
Trend Micro Apex Central modTMSL Server-Side Request Forgery Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro Apex Central. Authentication is required to exploit this vulnerability. The specific flaw exists within the modTMSL module. The issue results from the lack of proper validation of...
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to execute arbitrary code.
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to access to resources through incompatible types. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to trigger a service failure or execute arbitrary code.
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to access to resources through incompatible types. Exploiting this vulnerability can allow a malicious actor to cause service failures or execute arbitrary code using a specially crafted HTML page...
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to trigger a service failure or execute arbitrary code.
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to access to resources through incompatible types. Exploiting this vulnerability can allow a malicious actor to cause service failures or execute arbitrary code using a specially crafted HTML page...
Authorization Bypass
pimcore/customer-management-framework-bundle is vulnerable to Authorization Bypasses. The application uses improper authorization checks, allowing a malicious user to bypass the authorization mechanisms while trying to access a resource or perform actions...
"Cannot Complete Your Request" via Oauth after Upgrading NetScaler from 12.1 to 13.0
After ADC is upgraded from 12.1 to 13.0, the user keeps getting "Cannot Complete Your Request" when attempting to access resources through ADC with Oauth authentication. As a comparison, there is no issue accessing StoreFront directly in the intranet without Oauth...
FreeBSD : xmltooling -- remote resource access (f7e9a1cc-0931-11ee-94b4-6cc21735f730)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f7e9a1cc-0931-11ee-94b4-6cc21735f730 advisory. - Shibboleth consortium reports: An updated version of the XMLTooling library that is part of the...
Cannot add ADC URL to workspace with cannot connect to Server Error
Cannot add ADC URL to workspace with cannot connect to Server Error ADC use as gateway, with external environment Can access via Web browser and launch resource...
PYSEC-2023-20
Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur...
