818 matches found
Mozilla: Lack of warning when opening Diagcab files
The Mozilla Foundation Security Advisory describes this flaw as: When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code...
FreeBSD 授权问题漏洞
FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. FreeBSD suffers from a security vulnerability that stems from the inability of pamkrb5 to validate responses from the KDC if the key table is not configured on the system, which can be exploited by an attacker to...
Cross site scripting
Grav is a flat-file content management system. In versions 1.7.42 and prior, the "/forgotpassword" page has a self-reflected cross-site scripting vulnerability that can be exploited by injecting a script into the "email" parameter of the request. While this vulnerability can potentially allow an...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none...
SAP Diagnostics Agent 访问控制错误漏洞
SAP Diagnostics Agent is a system diagnostics agent program from SAP, Germany. An access control error vulnerability exists in SAP Diagnostics Agent version 720 that stems from a lack of authentication and code entry cleanup...
DEBIAN-CVE-2023-27537
A double free vulnerability exists in libcurl 8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread...
CVE-2023-27167
Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?searchmonth=1...
Sql injection
Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?searchmonth=1...
PT-2023-20984 · Suprema · Suprema Biostar 2
Name of the Vulnerable Software and Affected Versions: Suprema BioStar 2 version 2.8.16 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the values parameter at the "/users/absence?search month=1" API endpoint. Recommendations: For Suprem...
CVE-2023-27167
Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?searchmonth=1...
Suprema BioStar 2 SQL注入漏洞
Suprema BioStar 2 is a web-based biometric security smart lock platform from Suprema Korea. A security vulnerability exists in Suprema BioStar 2 version v2.8.16. An attacker can exploit the vulnerability to perform SQL injection via the values parameter at /users/absence?searchmonth=1...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none...
I Recommend This <= 3.8.3 - CSRF
The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
CVE-2023-1029
The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.3. This is due to missing or incorrect nonce validation on the regenerateSitemaps function. This makes it possible for unauthenticated attackers to regenerate Sitemaps via a forg...
PT-2023-10415 · Undefined · Undefined
Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The provided information does not contain details about a specific vulnerability, but rather a notification about a rejected CVE candidate number. There is no general information about...
PT-2023-10387 · Undefined · Undefined
Name of the Vulnerable Software and Affected Versions: No vulnerable software or affected versions specified. Description: The provided information does not contain details about a specific vulnerability. It appears to be a rejection notice for a candidate number, indicating that it was not...
SUSE CVE-2014-8680
The GeoIP functionality in ISC BIND 9.10.0 through 9.10.1 allows remote attackers to cause a denial of service assertion failure and named exit via vectors related to 1 the lack of GeoIP databases for both IPv4 and IPv6, or 2 IPv6 support with certain options...
SUSE CVE-2019-18838
An issue was discovered in Envoy 1.12.0. Upon receipt of a malformed HTTP request without a Host header, it sends an internally generated "Invalid request" response. This internally generated response is dispatched through the configured encoder filter chain before being sent to the client. An...
Kiwi TCMS 安全漏洞
Kiwi TCMS is a leading open source test management system for manual and automated testing from Kiwi TCMS Open Source. A security vulnerability exists in Kiwi TCMS versions prior to 12.0, which stems from the fact that the system is not rate-limited, which makes brute-force attacks on the login...