60 matches found
CVE-2024-34642
Improper authorization in One UI Home prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily access sensitive information...
CVE-2024-34642
Improper authorization in One UI Home prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily access sensitive information...
CVE-2024-34642
Improper authorization in One UI Home prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily access sensitive information...
Information Disclosure
gitlab is vulnerable to Information Disclosure. The vulnerability exists due to the incorrect header implementation in the project page, which allows an attacker to have temporary read access to the private repository...
CVE-2023-26448
Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit...
Default credentials
Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and...
Design/Logic Flaw
CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as root on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit 705bf1f...
Visual Voice Mail 访问控制错误漏洞
Visual Voice Mail is visual voicemail. An Access Control Error vulnerability exists in Visual Voice Mail that stems from the product allowing temporary access to read SMS messages and read an IMAP authentication message. The following products and versions are affected: Visual Voice Mail version...
PT-2021-3535 · WordPress · Kaswara Modern Vc Addons
Name of the Vulnerable Software and Affected Versions: Kaswara Modern VC Addons versions through 3.0.1 Description: The issue is related to unlimited file upload of dangerous types. Exploitation can allow a remote attacker to upload and execute arbitrary files. The vulnerability allows...
Identity at Microsoft Ignite: Strengthening Zero Trust defenses in the era of hybrid work
We’re now a year into our new reality, and two trends stand out. First, people need even more flexibility as we work, learn, and collaborate in a world without perimeters. And second, bad actors are getting even more sophisticated. They’re adding new attack vectors and combining them in new...
Identity at Microsoft Ignite: Strengthening Zero Trust defenses in the era of hybrid work
We’re now a year into our new reality, and two trends stand out. First, people need even more flexibility as we work, learn, and collaborate in a world without perimeters. And second, bad actors are getting even more sophisticated. They’re adding new attack vectors and combining them in new...
CVE-2021-22167
An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project page allows attacker to have a temporary read access to the private repository...
CVE-2021-22167
An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project page allows attacker to have a temporary read access to the private repository...
Design/Logic Flaw
An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project page allows attacker to have a temporary read access to the private repository...
CVE-2021-22167
An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project page allows attacker to have a temporary read access to the private repository...
CVE-2021-22167
Removed by vendor...
The vulnerability of the McAfee Client Proxy software lies in its ability to bypass authentication by using a user-controlled password. This allows attackers to circumvent web traffic scanning and gain access to blocked websites.
The vulnerability of the McAfee Client Proxy software relates to the bypassing of authentication procedures by using a key controlled by the user. Exploiting this vulnerability allows an attacker to bypass web traffic scanning and gain access to blocked websites for a short period of time. This i...
How to Create Custom IAM Role to Connect to the Repository
The backup service is using the IAM Role to generate temporary access keys to connect to the S3 bucket where backup data is stored Veeam Backup Object Repository...
CVE-2018-10239
A privilege escalation vulnerability in the "support access" feature on Infoblox NIOS 6.8 through 8.4.1 could allow a locally authenticated administrator to temporarily gain additional privileges on an affected device and perform actions within the super user scope. The vulnerability is due to a...
