2867 matches found
Cross site request forgery (csrf)
Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed such as Payment Settings...
CVE-2020-22273
Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed such as Payment Settings...
CVE-2020-22273
The CVE-2020-22273 entry concerns Neoflex Video Subscription System Version 2.0, where a CSRF flaw enables unauthorized changes to Website Settings (e.g., Payment Settings). The root cause is CSRF allowing state-changing requests without proper user verification. Documents consistently identify t...
receiving subscription objects with deleted session
Original Message: Hi, I create objects with one client with an ACL of all users with a specific column value. Thats working so far. Then I deleted the session object from one user to look if he can receive subscription objects and he can receive them. The client with the deleted session cant crea...
OPENSUSE-SU-2020:1752-1 Recommended update for mailman
This update for mailman to version 2.1.34 fixes the following issues: - The fix for lp1859104 can result in ValueError being thrown on attempts to subscribe to a list. This is fixed and extended to apply REFUSESECONDPENDING to unsubscription as well. lp1878458 - DMARC mitigation no longer misses ...
openSUSE Security Update : mailman (openSUSE-2020-1707)
This update for mailman to version 2.1.34 fixes the following issues : - The fix for lp1859104 can result in ValueError being thrown on attempts to subscribe to a list. This is fixed and extended to apply REFUSESECONDPENDING to unsubscription as well. lp1878458 - DMARC mitigation no longer misses...
Token Validation Bypass
parse-server is vulnerable to token validation bypass. Lack of checking deleted sessions after the websocket connection was established allows clients with invalid session tokens to still receive subscription object...
CVE-2020-15270
Parse Server npm package parse-server broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with invalid session tokens. The issue is not...
CVE-2020-15270
Parse Server npm package parse-server broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with invalid session tokens. The issue is not...
Design/Logic Flaw
Parse Server npm package parse-server broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with invalid session tokens. The issue is not...
CVE-2020-15270 Improper session expiration in Parse Server
Parse Server npm package parse-server broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with invalid session tokens. The issue is not...
CVE-2020-15270
Parse Server (parse-server) Vulnerability CVE-2020-15270: the Live Query mechanism allowed broadcasting subscription objects to clients with invalid/expired sessions because the session token validation was not enforced after the WebSocket connection was established. The issue is described in mul...
OPENSUSE-SU-2020:1707-1 Recommended update for mailman
This update for mailman to version 2.1.34 fixes the following issues: - The fix for lp1859104 can result in ValueError being thrown on attempts to subscribe to a list. This is fixed and extended to apply REFUSESECONDPENDING to unsubscription as well. lp1878458 - DMARC mitigation no longer misses ...
PT-2020-14328 · Parse · Parse Server
Name of the Vulnerable Software and Affected Versions: Parse Server versions 4.3.0 Description: The issue allows clients with expired sessions to still receive subscription objects because Parse Server broadcasts events to all clients without checking if the session token is valid. It is not...
Recommended update for mailman (moderate)
openSUSE Security Update: Recommended update for mailman Announcement ID: openSUSE-SU-2020:1707-1 Rating: moderate References: 1171363 1173369 Cross-References: CVE-2020-12108 CVE-2020-12137 CVE-2020-15011 Affected Products: openSUSE Leap 15.2 An update that fixes three vulnerabilities is now...
CS Money: Bypass restrict of member subscription to use custom background in https://3d.cs.money without prime subscription
Summary: In website https://3d.cs.money you need to subscribe prime to have a custom background for skin F999661 But with this vulnerability, we can use custom background without any fee required Steps To Reproduce: add details for how we can reproduce the issue - Grab a build of skin - Save it...
USN-4494-1 gupnp vulnerability
It was discovered that GUPnP incorrectly handled certain subscription requests. A remote attacker could possibly use this issue to exfiltrate data or use GUPnP to perform DDoS attacks...
Ubuntu 20.04 LTS : GUPnP vulnerability (USN-4494-1)
The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4494-1 advisory. It was discovered that GUPnP incorrectly handled certain subscription requests. A remote attacker could possibly use this issue to exfiltrate data or use GUPnP to...
CVE-2020-14391
A flaw was found in the GNOME Control Center, where it improperly uses Red Hat Customer Portal credentials when a user registers a system through the GNOME Settings User Interface. This flaw allows a local attacker to discover the Red Hat Customer Portal password. The highest threat from this...