PT-2020-13413 · Oauth +1 · Oauth +1

Name of the Vulnerable Software and Affected Versions: OAuth versions 12.3 through 13.0.1 Description: The issue concerns the OAuth flow missing verification checks, allowing an unverified user to use the OAuth authorization code flow. Recommendations: For versions 12.3 through 13.0.1, update to ...

PT-2020-13416 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 12.2 through 13.0.1 Description: A user with an unverified email address could request access to domain-restricted groups. Recommendations: For GitLab EE versions 12.2 through 13.0.1, update to a version that contains a fix...

CVE-2020-13275: Undefined Security Weakness

A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1...

CVE-2019-14042

Out of bound read in in fingerprint application due to requested data assigned to a local buffer without length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired...

Huawei Honor V20 Information Disclosure Vulnerability (CNVD-2020-27123)

Huawei Honor V20 is a smartphone from Chinese company Huawei Huawei. An information disclosure vulnerability exists in Huawei Honor V20 versions prior to 10.0.0.179 C636E3R4P3, prior to 10.0.0.180 C185E3R3P3, and prior to 10.0.0.180 C432E10R3P4, which stems from a program that does not adequately...

Denial Of Service (DoS)

samba is vulnerable to denial of service. The application does not verify device name and mountpoint strings, allowing local users to crash the application via a malicious string...

CVE-2020-7008

VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow input passed in the URL that is not properly verified before use, which may allow an attacker to read arbitrary files from local resources...

Semrush: IDOR in marketing calendar tool

INTRODUCTION I used two accounts to search for this vulnerability: Id: █████ Email: ██████ Id: ███ Email: ███ IP used: 78.194.169.36 Endpoint URL: https://ec.semrush.com/api/v1/ga/userstatus/?calendarid=CALENDARID EXPLOITATION Description of Security Issue: When a marketing calendar is loaded in...

Joomla! cross-site request forgery vulnerability (CNVD-2020-12775)

Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. A cross-site request forgery vulnerability exists in Joomla! The vulnerability stems from the WEB application not adequately verifying that a reques...

WordPress Tutor LMS Cross-Site Request Forgery Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress Tutor LMS. The vulnerability stems from the WEB applicatio...

Information disclosure

The kantan netprint App for Android 2.0.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

The vulnerability of the microprogramming software in Huawei Nova 5i pro and Nova 5 mobile phones, related to unverified array indexing, allows attackers to execute arbitrary code.

The vulnerability of the microprogramming software in Huawei Nova 5i pro and Nova 5 mobile phones is related to unverified array indexing. Exploiting this vulnerability could allow a hacker to execute arbitrary code through a specially created application...

The vulnerability of the RouterOS operating system’s automatic update function in MikroTik routers allows a intruder to gain unauthorized access to protected information.

The vulnerability of the RouterOS operating system’s automatic update function for MikroTik routers involves loading code without checking its integrity. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to protected information by resetting t...

The vulnerability of the canvas objects in browsers such as Firefox, Firefox ESR, and the email client Thunderbird allows attackers to disclose protected information.

The vulnerability of the Canvas object in browsers such as Firefox, Firefox ESR, and the email client Thunderbird is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability can allow an attacker to disclose protected information remotely...

CVE-2019-12394

Anviz access control devices allow unverified password change which allows remote attackers to change the administrator password without prior authentication...

CVE-2019-12394

Anviz access control devices allow unverified password change which allows remote attackers to change the administrator password without prior authentication...

CVE-2019-12394

CVE-2019-12394 affects Anviz access control devices, where an unverified password change allows remote attackers to change the administrator password without authentication. The connected RH Red Hat, CNVD, CNVD-like and other entries corroborate the vulnerability’s description across multiple fee...

NVIDIA Windows GPU Display Driver Code Execution Vulnerability

NVIDIA Windows GPU Display Driver is a graphics processor GPU graphics card driver from NVIDIA dedicated to the Windows platform. A code execution vulnerability exists in the NVIDIA Control Panel of the NVIDIA Windows GPU Display Driver. The vulnerability stems from the NVIDIA control panel...

CVE-2018-4064

An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a unverified device configuration change, resulting in an unverified change of the user password on the...

Cross site request forgery (csrf)

An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a unverified device configuration change, resulting in an unverified change of the user password on the...