CVE-2021-43572

The verify function in the Stark Bank Python ECDSA library aka starkbank-escada or ecdsa-python before 2.0.1 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages...

Stark Bank 数据伪造问题漏洞

Stark Bank is a banking API for individual developers in Brazil.Perform all banking operations through an API that simplifies and automates payments, facilitates reconciliations, and scales operations. Stark Bank ecdsa-elixir suffers from a Data Forgery Issue vulnerability that stems from the...

Stark Bank 数据伪造问题漏洞

Stark Bank is a banking API for individual developers in Brazil.Perform all banking operations through an API that simplifies and automates payments, facilitates reconciliations, and scales operations. Stark Bank Ecdsa-node suffers from a Data Forgery Issue vulnerability that stems from the...

CVE-2020-26547

Monal before 4.9 does not implement proper sender verification on MAM and Message Carbon XEP-0280 results. This allows a remote attacker able to send stanzas to a victim to inject arbitrary messages into the local history, with full control over the sender and receiver displayed to the victim...

Design/Logic Flaw

Monal before 4.9 does not implement proper sender verification on MAM and Message Carbon XEP-0280 results. This allows a remote attacker able to send stanzas to a victim to inject arbitrary messages into the local history, with full control over the sender and receiver displayed to the victim...

CVE-2020-26547

Monal before 4.9 does not implement proper sender verification on MAM and Message Carbon XEP-0280 results. This allows a remote attacker able to send stanzas to a victim to inject arbitrary messages into the local history, with full control over the sender and receiver displayed to the victim...

Github Monal Data Falsification Issue Vulnerability

Github Monal is a cross-platform modern XMPP client for iOS and macOS. Monal before 4.9 suffers from a data forgery issue vulnerability that stems from not properly validating the sender of results. An attacker can use this vulnerability to inject arbitrary messages into local history and take fu...

Information Disclosure

odoo is vulnerable to information disclosure. Insecure access controls in mail module notifications allows remote authenticated users to obtain access to arbitrary messages in conversations that are otherwise restricted...

CVE-2019-11784

Improper access control in mail module notifications in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users to obtain access to arbitrary messages in conversations they were not a party to...

Improper access control

Improper access control in mail module notifications in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users to obtain access to arbitrary messages in conversations they were not a party to...

CVE-2019-11784

Improper access control in mail module notifications in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users to obtain access to arbitrary messages in conversations they were not a party to...

CVE-2019-11784

Improper access control in mail module notifications in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users to obtain access to arbitrary messages in conversations they were not a party to...

CVE-2019-11784

Improper access control in mail module notifications in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users to obtain access to arbitrary messages in conversations they were not a party to...

Rocket.Chat: Improper ACL in Message Starring

The vulnerability allowed attackers to manipulate the starred attribute of arbitrary messages by providing an unrelated room ID where they had access. The vulnerability existed due to improper access checks when starring messages...

The vulnerability of the automated information system “Web-Torghi KS” arises from the lack of measures taken to protect the structure of the web page. This allows attackers to read arbitrary messages within the AI system.

The vulnerability of the automated information system “Web-Torghi KS” is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to read arbitrary messages within the AI system remotely...

Command injection

In Omron PLC CJ series, all versions and Omron PLC CS series, all versions, an attacker could spoof arbitrary messages or execute commands...

Code injection

Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API. By modifying an URL parameter in Mailvelope, an attacker is able to sign and encrypt arbitrary messages with Mailvelope, assuming the private key password is cached. A second vulnerability allows ...

CVE-2019-9149

Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API. By modifying an URL parameter in Mailvelope, an attacker is able to sign and encrypt arbitrary messages with Mailvelope, assuming the private key password is cached. A second vulnerability allows ...

CVE-2018-1666

CVE-2018-1666 affects IBM DataPower/DataPower Gateway UI message rendering. A authenticated user could inject arbitrary messages displayed in the UI. Affected products/versions include IBM DataPower Gateway 2018.4.1.0, 7.6.0.0–7.6.0.11, 7.5.2.0–7.5.2.18, 7.5.1.0–7.5.1.18, 7.5.0.0–7.5.0.19, and 7....

CVE-2018-1666

IBM DataPower Gateway 2018.4.1.0, 7.6.0.0 through 7.6.0.11, 7.5.2.0 through 7.5.2.18, 7.5.1.0 through 7.5.1.18, 7.5.0.0 through 7.5.0.19, and 7.7.0.0 through 7.7.1.3 could allow an authenticated user to inject arbitrary messages that would be displayed on the UI. IBM X-Force ID: 144892...