3581 matches found
CVE-2023-1202
Permission bypass when importing or synchronizing entries in User vault in Devolutions Remote Desktop Manager 2023.1.9 and prior versions allows users with restricted rights to bypass entry permission via id collision...
CVE-2023-20859
In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token...
PT-2023-17679 · Spring · Spring Vault
Name of the Vulnerable Software and Affected Versions: Spring Vault versions 2.3.x prior to 2.3.3 Spring Vault versions 3.0.x prior to 3.0.2 Description: The application is vulnerable to the insertion of sensitive information into a log file when it attempts to revoke a Vault batch token...
CVE-2023-20859
In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token...
PT-2023-17110 · Devolutions · Devolutions Server
Name of the Vulnerable Software and Affected Versions: Devolutions Server versions 2022.3.13 and prior Description: The issue allows users with restricted rights to bypass entry permission via id collision when importing or synchronizing entries in the User vault. Recommendations: For Devolutions...
CVE-2023-20859
In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token...
CVE-2023-20859
CVE-2023-20859 affects Spring Vault: 3.0.x prior to 3.0.2 and 2.3.x prior to 2.3.3 (and older versions). The issue allows insertion of sensitive information into log files when revoking a Vault batch token, potentially exposing confidential data on local systems. The NVD metrics show a Local, Low...
PT-2023-16817 · Devolutions · Devolutions Remote Desktop Manager
Name of the Vulnerable Software and Affected Versions: Devolutions Remote Desktop Manager versions 2023.1.9 and prior Description: The issue allows users with restricted rights to bypass entry permission via id collision when importing or synchronizing entries in the User vault. Recommendations:...
Spring Vault 日志信息泄露漏洞
VMware Spring Vault is VMware's allows applications to transparently access confidential information stored in Vault. A security vulnerability exists in Spring Vault 3.0.series versions prior to 3.0.2, 3.0.2 series versions prior to 2.3.3, which stems from an application's tendency to insert...
Potential lose of Vault control
Lines of code Vulnerability details Impact If by any means this function is not called first by the creators anyone can be the one to define it forever since there is no verification, after that the attacker will have complete control over the mint and burn functions. Proof of Concept function...
[H-3] Any account can mint or burn an unlimited number of vault tokens and drain the Kangaroo Vault.
Lines of code Vulnerability details Impact This is a failure in setting up access control. Anyone could set the vault address to their address and call the mint/burn function to mint and burn vault tokens. The impact is severe since all the funds in Kangaroo vault can be withdrawn by anyone. Proo...
The KangarooVault liquidity providers receive a wrong vault token amount because an error in the processDepositQueue() function
Lines of code Vulnerability details Impact The KangarooVault.sol::processDepositQueue function helps to process the queued deposits. The deposits are queued if the KangarooVault vault doesn't have registered positions. The processDepositQueue function calls the getTokenPrice function to be able t...
Insertion of Sensitive Information into Log Sourced from Failed Revocation of Tokens
In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token. Specifically, an application is vulnerable when all of the...
Vault staked along with "Hands of the Citadel" does not have any effect but still be locked
Lines of code Vulnerability details Impact In function stakeS1Citizen, when the S1 citizen has class Hands of Citadel, it will ignore the vault staked but still transfer the vault into Staking contract. It will effectively lock the vault for timelockDuration but does not have any effect on...
Executing getCreditYield(citizenId, citizenVaultId) in NeoTokyoStaker._stakeS1Citizen function can cause identityPoints to be lower than it should be when corresponding S1 Citizen to be staked does not have a component vault but an optional vault is provided
Lines of code Vulnerability details Impact Calling the following NeoTokyoStaker.stakeS1Citizen function executes string memory citizenCreditYield = getCreditYieldcitizenId, citizenVaultId and uint256 identityPoints = identityCreditPointscitizenCreditYield. When the S1 Citizen to be staked does no...
CVE-2022-47171
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Paul C. Schroeder IP Vault – WP Firewall plugin = 1.1 versions...
CVE-2022-47171
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Paul C. Schroeder IP Vault – WP Firewall plugin = 1.1 versions...
CVE-2022-47171 WordPress IP Vault – WP Firewall Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Paul C. Schroeder IP Vault – WP Firewall plugin = 1.1 versions...
CVE-2022-47171 WordPress IP Vault – WP Firewall Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Paul C. Schroeder IP Vault – WP Firewall plugin = 1.1 versions...
CVE-2022-47171
CVE-2022-47171 affects the Paul C. Schroeder IP Vault – WP Firewall plugin for WordPress, specifically versions <= 1.1. The issue is a Cross-Site Scripting (XSS) vulnerability caused by improper input neutralization during web page generation. Impact is described as low severity with Privilege...