175 matches found
CVE-2024-21641 Flarum's Logout Route allows open redirects
Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum /logout route includes a redirect parameter that allows any third party to redirect users from a trusted domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be...
hw: Intel: Unauthorized error injection in Intel SGX or Intel TDX
A flaw was found in hw. Unauthorized error injection in IntelR SGX or IntelR TDX for some IntelR XeonR processors may allow a privileged user to potentially enable escalation of privilege via local access...
SUSE CVE-2022-41804
Unauthorized error injection in IntelR SGX or IntelR TDX for some IntelR XeonR Processors may allow a privileged user to potentially enable escalation of privilege via local access...
Intel Xeon Processors Security Vulnerability
Intel Xeon Processors is an Intel Xeon family of central processing units CPUs from Intel Corporation. A security vulnerability exists in IntelR SGX and IntelR TDX of Intel Xeon Processors. An attacker can exploit the vulnerability to elevate privileges...
UBUNTU-CVE-2022-41804
Unauthorized error injection in IntelR SGX or IntelR TDX for some IntelR XeonR Processors may allow a privileged user to potentially enable escalation of privilege via local access...
Python Cryptographic Authority: Error Page Content Spoofing or Text Injection
An error page content spoofing vulnerability was discovered on the cryptography.io domain. This vulnerability allowed an attacker to inject arbitrary text into the page, potentially leading to social engineering attacks. The issue has been resolved by removing the injected content from the page...
Cannot complete your request on Gateway URL after adding new domain to trusted domains
After adding a trusted domain to Storefront. when you go to "Manage Authentication Methods", click on the settings, click on "Configure trusted Domains" and add new domains, when users try to go to the gateway URL, you may get either "Login Expired" or "Cannot Complete your Request|" error messag...
Error connecting to PVS Farm with Credentials from trusted domain using Selective Trust
When connecting to the PVS Farm "localhost" with credentials from a trusted domain, an error is thrown that reads: "Error Domain Controller" and "unable to connect to the domain Controller if any or the default rootDSE. Error code: 60075030, message: Access is denied Exception from HRESULT:...
Krisp: Error Page Content Spoofing or Text Injection
Summary: Error Page Content Spoofing or Text Injection in two urls Target: https://download.prelive.krisp.ai/ Target:https://upld.prelive.krisp.ai/ Description: Content spoofing, also referred to as content injection, "arbitrary text injection" or virtual defacement, is an attack targeting a user...
CVE-2021-22470
A component of the HarmonyOS has a Privileges Controls vulnerability. Local attackers may exploit this vulnerability to expand the Recording Trusted Domain...
CVE-2021-22470
A component of the HarmonyOS has a Privileges Controls vulnerability. Local attackers may exploit this vulnerability to expand the Recording Trusted Domain...
Design/Logic Flaw
A component of the HarmonyOS has a Privileges Controls vulnerability. Local attackers may exploit this vulnerability to expand the Recording Trusted Domain...
CVE-2021-22470
A component of the HarmonyOS has a Privileges Controls vulnerability. Local attackers may exploit this vulnerability to expand the Recording Trusted Domain...
CVE-2021-22470
A component of the HarmonyOS has a Privileges Controls vulnerability. Local attackers may exploit this vulnerability to expand the Recording Trusted Domain...
HUAWEI HarmonyOS 安全漏洞
Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A privilege bypass vulnerability exists in HarmonyOS prior to version 2.0, which stems from a privilege control vulnerability in a component of HarmonyOS tha...
in chatwoot/chatwoot
Description chatwoot failed to validate the original email when a user changing his/her email address in Profile Setting, An attacker may use the mechanism to forge arbitrary email（especially in trusted domain） Proof of Concept my original email is：[email protected], and I had confirmed it b...
Basecamp: Error Page Content Spoofing or Text Injection
Target: https://gopher.hey.com/ Description: Content spoofing, also referred to as content injection, "arbitrary text injection" or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. When an application does not properly handle...
CVE-2021-20025
SonicWall Email Security Virtual Appliance version 10.0.9 and earlier versions contain a default username and a password that is used at initial setup. An attacker could exploit this transitional/temporary user account from the trusted domain to access the Virtual Appliance remotely only when the...
CVE-2021-20025
SonicWall Email Security Virtual Appliance version 10.0.9 and earlier versions contain a default username and a password that is used at initial setup. An attacker could exploit this transitional/temporary user account from the trusted domain to access the Virtual Appliance remotely only when the...
CVE-2021-20025
SonicWall Email Security Virtual Appliance version 10.0.9 and earlier versions contain a default username and a password that is used at initial setup. An attacker could exploit this transitional/temporary user account from the trusted domain to access the Virtual Appliance remotely only when the...