1138 matches found
Insecure Access Control
ssddanbrown/bookstack does not properly validate user's access. The permission service allows users to obtain unauthorized access to the API, enabling users to view any attachment without having permission...
PT-2022-11304 · Alt Linux · Alt Linux
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue allows a student to view their quiz grade before it has been released, utilizing a quiz web service. No information is provided about the...
Philips Patient Information Center iX 输入验证错误漏洞
Philips Patient Information Center iX Philips Patient Information Center PIC iX, a Philips company in Europe, is at the heart of our patient monitoring system, which facilitates understanding of the patient's condition and helps caregivers to identify potential deterioration at an early stage, as...
The vulnerability of the DJVU reading component in the viewing, creation, and editing of DjVU files by DjVuLibre allows a hacker to cause a service failure by exploiting the issue related to buffer overflows.
The vulnerability of the DJVU reading component in the viewing, creation, and editing of DjVu files in DjVuLibre involves reading data beyond the allowed boundaries of the buffer. Exploiting this vulnerability can allow an attacker to cause a service failure...
CVE-2021-32951 Advantech WebAccess/NMS Improper Authentication
WebAccess/NMS Versions prior to v3.0.3Build6299 has an improper authentication vulnerability, which may allow unauthorized users to view resources monitored and controlled by the WebAccess/NMS, as well as IP addresses and names of all the devices managed via WebAccess/NMS...
CVE-2021-24774
The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statement when viewing logs, leading to SQL injections issues...
Oracle Outside In Technology Denial of Service Vulnerability (CNVD-2021-81796)
Oracle Outside In Technology is a software development kit SDK that provides developers with a comprehensive solution for extracting, normalizing, cleaning, converting, and viewing content in more than 600 unstructured file formats. A denial of service vulnerability in the Outside In Filters...
Oracle Outside In Technology Denial of Service Vulnerability (CNVD-2021-81800)
Oracle Outside In Technology is a software development kit SDK that provides developers with a comprehensive solution for extracting, normalizing, cleaning, converting, and viewing content in more than 600 unstructured file formats. A denial of service vulnerability in the Outside In Filters...
Vulnerability fixed in Microsoft System Center Operations Manager
Microsoft has fixed a vulnerability in System Center Operations Manager SCOM. The vulnerability allows a malicious remotely able to view files. The vulnerability is only exploitable on SCOM systems that have the web console installed. System Center:...
Booking Core Access Control Error Vulnerability
Booking Core is a software application. A Laravel based booking system designed for travel websites, malls, travel agencies, tour operators, B&Bs, villa rentals, resort rentals, Make Travel websites. An Access Control Error vulnerability exists in Booking Core 2.0, which can be exploited by an...
CVE-2021-39226: Improper Authentication
Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "publicmode" configurati...
CVE-2021-41584
Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response information disclosure of possibly sensitive build/configuration details via a crafted HTTP request with the X-Gradle-Enterprise-Ajax-Request header...
Externally Controlled Reference to a Resource in Another Sphere
A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the lo...
CVE-2021-24724
The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s...
The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2015 are related to the manipulation of the null pointer, allowing attackers to trigger service interruptions.
The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2015 are related to the handling of the null pointer. Exploiting these vulnerabilities can allow...
The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat, and Adobe Acrobat Reader involve an attack vector that extends beyond the buffer in memory, allowing attackers to gain unauthorized access to protected information.
The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2019, and Adobe Acrobat Reader 2019 are related to the execution of operations beyond the buffer in memory. Exploiting these vulnerabilities can allow...
The vulnerability of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, and Adobe Acrobat 2017/Adobe Acrobat Reader 2017 arises due to an operation that goes beyond the buffer in memory, allowing attackers to disclose protected information.
The vulnerability of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, and Adobe Acrobat Reader 2017 arises due to an operation that goes beyond the buffer in memory. Exploiting this vulnerability can allow a malicious...
Form Tools 跨站脚本漏洞
A cross-site scripting vulnerability exists in Form Tools 3.0.20 and earlier. An attacker could use the submissionid parameter to trigger a stored cross-site scripting attack when viewing a form...
