2200 matches found
CLSA-2022-1668117586 Fix CVE(s): CVE-2019-2386
SECURITY UPDATE: After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones - debian/patches/CVE-2019-2386.patch: Validate...
CVE-2022-42905
creationtimestamp| type| source ---|---|--- 2022-11-07 02:33:44+00:00| seen| https://t.me/cibsecurity/52577 2023-01-17 10:37:08+00:00| seen| https://t.me/techb0ltGenona/3521 2024-01-26 18:07:14+00:00| seen| https://t.me/arpsyndicate/3026 2026-09-01 20:01:05+00:00| seen|...
DEBIAN-CVE-2022-40284
A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code execution. A local attacker can exploit this if the ntfs-3g binary is setuid root. A physically proximate attacker can exploit this if NTFS-3G software is configured to execute upon...
PT-2022-26808 · Unknown · Canteen Management System
Name of the Vulnerable Software and Affected Versions: Canteen Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the userid parameter at the "/php action/fetchSelectedUser.php" API endpoint. Recommendations: F...
The vulnerability of the Fortinet FortiNAC access control device lies in its lack of measures to protect the website structure, allowing attackers to execute cross-site scripting attacks.
The vulnerability of the Fortinet FortiNAC network access control device is related to the lack of protection for the website structure when processing the User ID parameter for the administrator. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...
CVE-2022-40178
creationtimestamp| type| source ---|---|--- 2022-10-11 14:25:57+00:00| seen| https://t.me/cibsecurity/51107...
CVE-2022-32171
In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s...
PT-2022-21134 · Zinc · Zinc
Name of the Vulnerable Software and Affected Versions: Zinc versions v0.1.9 through v0.3.1 Description: The issue is related to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript...
CVE-2022-32171: Improper Neutralization of Input During Web Page Generation
In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s...
CVE-2022-40341
creationtimestamp| type| source ---|---|--- 2022-09-30 22:36:37+00:00| seen| https://t.me/cibsecurity/50806...
CVE-2022-28851
creationtimestamp| type| source ---|---|--- 2022-09-30 20:36:17+00:00| seen| https://t.me/cibsecurity/50778...
Bytebase allows low-privilege users to view admin projects
Overview The "Bytebase" application does not restrict low privilege user from accessing admin projects Details The "Bytebase" application does not restrict low privilege user from accessing admin projects for which an unauthorized user can view the "projects" created by "Admin". The affected...
IBM Rational Asset Manager 安全漏洞
IBM Rational Asset Manager is a collaborative software development tool from IBM, USA. Organizations can use it to identify, manage and govern the design, development and use of software assets and services. A privilege control issue vulnerability exists in IBM Rational Asset Manager version 7.5...
ieGeek IG20 安全特征问题漏洞
The ieGeek IG20 is a webcam from ieGeek. A security vulnerability exists in the ieGeek IG20 hipcam RealServer version V1.0, which stems from a predictability flaw in the algorithm that generates the device id uid as a result of its faulty access control, allowing a remote attacker to directly...
CVE-2022-35089
creationtimestamp| type| source ---|---|--- 2022-09-21 07:40:22+00:00| seen| https://t.me/cibsecurity/50169...
CVE-2022-39008
creationtimestamp| type| source ---|---|--- 2022-09-16 22:35:15+00:00| seen| https://t.me/cibsecurity/49971...
CVE-2022-38864
creationtimestamp| type| source ---|---|--- 2022-09-15 18:27:32+00:00| seen| https://t.me/cibsecurity/49814...
CVE-2022-37138
creationtimestamp| type| source ---|---|--- 2022-09-14 14:26:21+00:00| seen| https://t.me/cibsecurity/49757...