2299 matches found
Improper Authentication
github.com/pocketbase/pocketbase is vulnerable to Improper Authentication. The vulnerability is due to unverified account linking because an attacker can create an unverified account with the targeted user's email, and when the user signs up with OAuth2, their account is linked without changing t...
The vulnerability of the command-line interface of FortiOS operating systems and the FortiProx proxy server, which allows a hacker to decrypt the backup file.
The vulnerability of the command-line interface of FortiOS operating systems and the FortiProxy proxy server for protecting against Internet attacks is related to insufficient calculation of password hashes. Exploiting this vulnerability can allow attackers to decrypt the backup file...
CVE-2024-27180
CVE-2024-27180 is described as a TOCTOU-type vulnerability in Toshiba e-STUDIO MFPs where an attacker with admin access can install rogue applications. The Initial description is minimal, and connected sources corroborate a vulnerability pattern affecting Toshiba multi-function printers, with bro...
CVE-2024-5557
CWE-532: Insertion of Sensitive Information into Log File vulnerability exists that could cause exposure of SNMP credentials when an attacker has access to the controller logs...
CVE-2024-35208
A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V1.2. The affected web server stored the password in cleartext. This could allow attacker in a privileged position to obtain access passwords...
CVE-2024-34683 Unrestricted file upload in SAP Document Builder (HTTP service)
An authenticated attacker can upload malicious file to SAP Document Builder service. When the victim accesses this file, the attacker is allowed to access, modify, or make the related information unavailable in the victimās browser...
CVE-2024-34683 Unrestricted file upload in SAP Document Builder (HTTP service)
An authenticated attacker can upload malicious file to SAP Document Builder service. When the victim accesses this file, the attacker is allowed to access, modify, or make the related information unavailable in the victimās browser...
CVE-2024-27819
The issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access may be able to access contacts from the lock screen...
CVE-2024-3592 Quiz And Survey Master ā Best Quiz, Exam and Survey Plugin for WordPress <= 9.0.1 - Authenticated (Contributor+) SQL Injection
The Quiz And Survey Master ā Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'questionid' parameter in all versions up to, and including, 9.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatio...
The vulnerability of the hyper-converged infrastructure of IBM Storage Fusion HCI, related to the use of strictly encrypted authentication data, allows a intruder to gain unauthorized access to protected information.
The vulnerability of the high-convergence infrastructure of IBM Storage Fusion HCI is related to the use of strictly encrypted account data. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...
CVE-2024-4376
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all versions up to, and including, 4.10.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
ROS-20240529-04
A vulnerability in the ImageIO component of the Oracle Java SE software platform and the Oracle GraalVM Virtual Machine Enterprise Edition is related to integer overflow. Exploitation of the vulnerability could allow an attacker acting remotely to cause a partial denial of service Vulnerability i...
CVE-2024-23580 HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs)
HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords OTPs. This could allow an attacker with access to the database to recover some or all encrypted values...
ROS-20240422-10
A vulnerability in the SSH protocol implementation is related to the ability to adjust packet sequence numbers during the connection negotiation process and remove an arbitrary number of SSH service messages. during the connection negotiation process and cause an arbitrary number of SSH service...
CVE-2024-5040
There are multiple ways in LCDS LAquis SCADA for an attacker to access locations outside of their own directory...
CVE-2024-36078
In Zammad before 6.3.1, a Ruby gem bundled by Zammad is installed with world-writable file permissions. This allowed a local attacker on the server to modify the gem's files, injecting arbitrary code into Zammad processes which run with the environment and permissions of the Zammad user...
PT-2024-5465 Ā· MicrosoftĀ +6 Ā· EdgeĀ +6
Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 126.0.6478.182 Chromium versions prior to 126.0.6478.182 Yandex Browser versions prior to 24.7.6.1018-alt1 Chromedriver versions prior to 126.0.6478.182-1.1 Debian Bookworm chromium versions prior to...
CVE-2024-32053
Hard-coded credentials are used by the CyberPower PowerPanel platform to authenticate to the database, other services, and the cloud. This could result in an attacker gaining access to services with the privileges of a Powerpanel business application...
CVE-2024-32047
Hard-coded credentials for the CyberPower PowerPanel test server can be found in the production code. This might result in an attacker gaining access to the testing or production server...
CVE-2024-32047 CyberPower PowerPanel business Active Debug Code
Hard-coded credentials for the CyberPower PowerPanel test server can be found in the production code. This might result in an attacker gaining access to the testing or production server...