PT-2025-2718 · Ibm · Ibm Security Verify Access +1

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Access versions 10.0.0 through 10.0.8 IBM Security Verify Access Docker versions 10.0.0 through 10.0.8 Description: The issue allows an unverified user to change the password of an expired user without prior knowledge of...

GitLab 12.3 < 12.9.8 / 12.10 < 12.10.7 / 13.0 < 13.0.1 (CVE-2020-13272)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow CVE-2020-13272 Note that Nessus has not tested for this issue but...

BIT-GITLAB-2020-13272

OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow...

kernel: Denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c

A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of...

kernel: Denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c

A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of...

The vulnerability of the Google Chrome browser’s Navigation function, which allows a hacker to perform a spoofing attack

The vulnerability of Google Chrome’s Navigation function exists due to insufficient verification of data entered by users. Exploiting this vulnerability allows a malicious actor to carry out a spamming attack using a specially created web page...

Siemens SCALANCE Privilege Escalation (CVE-2013-3633)

A vulnerability has been identified in SCALANCE X-200 switch family incl. SIPLUS NET variants Versions V5.0.0 for CVE-2013-3633 and versions V4.5.0 for CVE-2013-3634, SCALANCE X-200IRT switch family incl. SIPLUS NET variants All versions V5.1.0. The user privileges for the web interface are only...

LinkedIn: A Unverified User Can Post Newsletter (Which Is Not Allowed Through Application UI)

A vulnerability was discovered in LinkedIn that allowed unverified users to create newsletters, even though this feature was not accessible to them through the application's user interface. By sending a specific request with the unverified user's cookie, the newsletter creation API could be...

CVE-2020-13272

OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow...

Authorization

OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow...

CVE-2020-13272

OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow...

CVE-2020-13272

Removed by vendor...

Authentication Bypass

github.com/snapcore/snapweb is vulnerable to authentication bypass. The identity of the user and the origin of a connection is not verified before allowing controls to install or remove snap packages. An unauthenticated remote attacker is able to add a malicious snap package from the store and us...

Directory traversal vulnerability in Action View in Ruby on Rails

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing...

Multiple Westermo Router Spoofing Vulnerabilities

The RD-305-DIN, MRD-315, MRD-355, and MRD-455 are all Westermo router devices. A spoofing vulnerability exists in multiple Westermo routers, where an attacker could potentially spoof a user into making a malicious request to a server because the program does not verify that the user intended to...

Possible Information Leak Vulnerability

Applications that pass unverified user input to the render method in a controller may be vulnerable to an information leak vulnerability. Impacted code will look something like this: def index; render params:id; end Carefully crafted requests can cause the above code to render files from unexpect...

Possible Information Leak Vulnerability in Action View

There is a possible directory traversal and information leak vulnerability in Action View. This vulnerability has been assigned the CVE identifier CVE-2016-0752. Versions Affected: All. Not affected: None. Fixed Versions: 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1 Impact ------ Applications that...