CVE-2024-7596: Undefined Security Weakness

Proposed Generic UDP Encapsulation GUE IETF Draft do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an exposed network interface that can lead to spoofing, access control bypass, and other unexpected network behaviors. This can ...

The vulnerability of packet tunneling protocols for IPv4-to-IPv6 and IPv6-to-IPv4 protocols arises from insufficient checks on the source of the communication channel. This allows attackers to execute attacks such as “spoofing of trusted objects”.

The vulnerability of IPv4-to-Ipv6 and IPv6-to-Ipv4 tunneling protocols is related to insufficient checks on the source of the communication channel. Exploiting this vulnerability allows a remote attacker to execute “host object substitution” attacks by sending a specially crafted packet with two ...

PT-2025-1236 · Ietf · Proposed Generic Udp Encapsulation

Name of the Vulnerable Software and Affected Versions: Proposed Generic UDP Encapsulation GUE IETF Draft affected versions not specified Description: The issue concerns the lack of validation or verification of the source of a network packet in the Proposed Generic UDP Encapsulation GUE IETF Draf...

Trend Micro Apex One 安全漏洞

Trend Micro Apex One is an endpoint protection software from Trend Micro. A security vulnerability exists in Trend Micro Apex One that stems from the presence of a source validation error vulnerability that allows a local attacker to elevate privileges on an affected installation...

Dataprom Informatics Personnel Attendance Control Systems (PACS)和Access Control Security Systems (ACSS) 访问控制错误漏洞

Access Control Security Systems ACSS and Dataprom Informatics Personnel Attendance Control Systems PACS are both products of Dataprom Informatics.Access Control Security Systems ACSS is a security access control system that is used to control and manage access to specific areas or...

BIT-MATTERMOST-2024-41926

Mattermost versions 9.9.x = 9.9.0 and 9.5.x = 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote...

DEBIAN-CVE-2024-36008

In the Linux kernel, the following vulnerability has been resolved: ipv4: check for NULL idev in iprouteusehint syzbot was able to trigger a NULL deref in fibvalidatesource in an old tree 1. It appears the bug exists in latest trees. All calls to indevgetrcu must be checked for a NULL result. 1...

ROS-20240514-02

A vulnerability in the Apache Maven framework is related to a flaw in the data source validation mechanism. Exploitation of the vulnerability could allow an attacker acting remotely to gain unauthorized access to protected information...

F5 BIG-IP APM Browser Web Access VPN Client Source Authentication Error Vulnerability

F5 BIG-IP APM is a suite of access and security solutions from F5 USA. The product provides unified access to business-critical applications and networks. A source validation error vulnerability exists in the F5 BIG-IP APM Browser Web Access VPN Client, which can be exploited by an attacker to...

F5 BIG-IP APM 安全漏洞

F5 BIG-IP APM is a suite of access and security solutions from F5 USA. The product provides unified access to business-critical applications and networks. A source validation error vulnerability exists in the F5 BIG-IP APM Browser Web Access VPN Client, which can be exploited by an attacker to...

ROS-20240503-18

A vulnerability in the Apache Maven framework is related to the generation of double-quoted strings without proper escaping. Exploitation of the vulnerability could allow an attacker acting remotely to conduct a shell-based attack. shell attacks A vulnerability in the Apache Maven framework is...

ROS-20240410-17

The vulnerability of the ImageBuild function of the Moby containerization software tool is related to a flaw in the data source validation mechanism for endpoint processing. is related to a flaw in the data source validation mechanism for endpoint processing. Exploitation of the vulnerability cou...

CVE-2023-50731 MindsDB has arbitrary file write in file.py

MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the put method in mindsdb/mindsdb/api/http/namespaces/file.py does not validate the user-controlled name value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which...

Zscaler Client Connector Access Control Error Vulnerability

Zscaler Client Connector is an application from zscaler. An application installed on a device that ensures that Internet traffic and access to an organization's internal applications are secure and in compliance with the organization's policies, even when not on the corporate network. A security...

Zscaler Client Connector Access Control Error Vulnerability

Zscaler Client Connector is an application from zscaler. An application installed on a device that ensures that Internet traffic and access to an organization's internal applications are secure and in compliance with the organization's policies, even when not on the corporate network. A security...

CVE-2023-41627

O-RAN Software Community ric-plt-lib-rmr v4.9.0 does not validate the source of the routing tables it receives, potentially allowing attackers to send forged routing tables to the device...

PT-2023-28007 · O Ran Software Community · Ric-Plt-Lib-Rmr

Name of the Vulnerable Software and Affected Versions: O-RAN Software Community ric-plt-lib-rmr version 4.9.0 Description: The issue is related to the lack of validation of the source of routing tables received by the device, potentially allowing attackers to send forged routing tables. This coul...

Slate 访问控制错误漏洞

slate is an extensible WYSIWYG web application from slate for quickly creating interactive, data-driven web pages. A security vulnerability exists in Slate versions prior to 6.207.0, which stems from a lack of source validation in the sandbox that could be exploited by a malicious user to modify...

NodeBB 访问控制错误漏洞

NodeBB is a forum system from the Design Create Play team built using Node.js, a web application platform built on top of Google's V8 JavaScript engine. A security vulnerability exists in NodeBB that stems from a lack of valid authentication of the source of requests...

Path Traversal

mlflow is vulnerable to Path Traversal. The vulnerability exists due to the improper source validation in the validatesource function of handlers.py, which allows an attacker to access files outside the expected directory through relative paths...