CVE-2022-45429

Some Dahua software products have a vulnerability of server-side request forgery SSRF. An Attacker can access internal resources by concatenating links URL that conform to specific rules...

CVE-2022-31683

Concourse 7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9 contains an authorization bypass issue. A Concourse user can send a request with body including :teamname=team2 to bypass team scope check to gain access to certain resources belong to any other team...

Open-Xchange OX App Suite 代码问题漏洞

Open-Xchange OX App Suite is an email and productivity suite client software from Open-Xchange Germany. A security vulnerability exists in Open-Xchange OX App Suite version 7.10.6 and earlier, which stems from the use of a malicious DNS record with multiple A or AAAA responses can bypass the deni...

CVE-2022-3774

A vulnerability was found in SourceCodester Train Scheduler App 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /trainschedulerapp/?action=delete. The manipulation of the argument id leads to improper control of resource identifiers. The attack may...

CVE-2022-2508

In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging...

PT-2022-6846 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13 Description: The issue is related to a buffer overflow in memory, which may allow a remote attacker to execute arbitrary code. This can be done with kernel privileges, potentially leading to significant system...

CVE-2022-2971

MZ Automation's libIEC61850 versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e accesses a resource using an incompatible type, which could allow an attacker to crash the server with a malicious payload...

CVE-2022-2971

CVE-2022-2971 affects MZ Automation libIEC61850 (versions 1.4 and prior; 1.5 prior to commit a3b04b7) and is a type confusion vulnerability that could cause the server to crash when handling a malicious payload. The available documents identify the root cause as accessing a resource using an inco...

CVE-2022-2971 MZ Automation libIEC61850 Access of Resource Using Incompatible Type ('Type Confusion')

MZ Automation's libIEC61850 versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e accesses a resource using an incompatible type, which could allow an attacker to crash the server with a malicious payload...

CVE-2021-46834

A permission bypass vulnerability in Huawei cross device task management could allow an attacker to access certain resource in the attacked devices. Affected product versions include:JAD-AL50 versions 102.0.0.225C00E220R3P4...

Design/Logic Flaw

A permission bypass vulnerability in Huawei cross device task management could allow an attacker to access certain resource in the attacked devices. Affected product versions include:JAD-AL50 versions 102.0.0.225C00E220R3P4...

CVE-2021-46834

CVE-2021-46834 describes a permission-bypass vulnerability in Huawei’s cross-device task management affecting Huawei JAD-AL50 software (version 102.0.0.225). The flaw permits an attacker with local access and low privileges, with no user interaction, to access certain resources on the attacked de...

CVE-2021-46834

A permission bypass vulnerability in Huawei cross device task management could allow an attacker to access certain resource in the attacked devices. Affected product versions include:JAD-AL50 versions 102.0.0.225C00E220R3P4...

CVE-2021-46834

A permission bypass vulnerability in Huawei cross device task management could allow an attacker to access certain resource in the attacked devices. Affected product versions include:JAD-AL50 versions 102.0.0.225C00E220R3P4...

CVE-2022-39957

The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web...

The vulnerability of the libIEC61850 library, related to access to resources through incompatible types, allows a perpetrator to cause a service failure.

The vulnerability of the libIEC61850 library is related to access to resources through incompatible types. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

CVE-2022-30625 Chcnav - P5E GNSS Directory listing

Directory listing is a web server function that displays the directory contents when there is no index file in a specific website directory. A directory listing provides an attacker with the complete index of all the resources located inside of the directory. The specific risks and consequences...

The vulnerabilities of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, are related to access to resources through incompatible types. This allows attackers to execute arbitrary code.

The vulnerabilities of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, are related to access to resources through incompatible types. Exploiting these vulnerabilities can allow attackers to execute...

CVE-2022-30625

Directory listing is a web server function that displays the directory contents when there is no index file in a specific website directory. A directory listing provides an attacker with the complete index of all the resources located inside of the directory. The specific risks and consequences...

keycloak-services: ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader

ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available...