2296 matches found
CVE-2021-40046
PCManager versions 11.1.1.95 has a privilege escalation vulnerability. Successful exploit could allow the attacker to access certain resource beyond its privilege...
Authorization Bypass
urijs is vulnerable to Authorization Bypass. The vulnerability exists in the User-Controlled Key due to the case-sensitive checks which not properly configured, allowing an attacker to bypass and gain access...
CVE-2021-44521
A flaw was found in Cassandra that allows users with certain permissions to execute user-defined functions to create scripts and run remote code execution. This flaw allows an attacker to gain unwanted access and also execute actions against Cassandra...
GO-2022-0646 CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go
A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code MAC, which then allows an attacker who has write access to the target's S3 bucket and can observe...
Improper Output Neutralization and Improper Encoding or Escaping of Output for Logs in ansible
An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri...
Improper access control
A vulnerability has been identified in SICAM TOOLBOX II All versions. Affected applications use a circumventable access control within a database service. This could allow an attacker to access the database...
The vulnerability of the Libgcrypt cryptographic library, which stems from the use of weak cryptographic algorithms, allows attackers to gain access to confidential information.
The vulnerability of the Libgcrypt cryptographic library lies in the use of a weak cryptographic algorithm. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to confidential information within the system...
treq 信息泄露漏洞
treq is an advanced Twisted HTTP client API. An information disclosure vulnerability exists in treq, which could allow an attacker to obtain sensitive information...
Microweber 信息泄露漏洞
Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. microweber has an information disclosure vulnerability, which stems from errors in the...
The vulnerability of the Netty network programming framework lies in the creation of temporary files with insecure permissions, allowing attackers to access confidential data.
The vulnerability of the Netty network programming framework lies in the creation of temporary files with insecure permissions. Exploiting this vulnerability can allow an attacker to gain access to confidential data...
CVE-2022-21288
Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: General. Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physica...
OpenJDK: Incorrect reading of TIFF files in TIFFNullDecompressor (ImageIO, 8270952)
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: ImageIO. Supported versions that are affected are Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows...
Schneider Electric Easergy P5 Trust Management Issue Vulnerability
The Schneider Electric Easergy P5 is a protective relay for demanding medium voltage applications from Schneider Electric, France. The Schneider Electric Easergy P5 is vulnerable to a trust management issue, which exists due to the presence of hard-coded credentials in the application code. An...
CVE-2022-0013
A file information exposure vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker to read the contents of arbitrary files on the system with elevated privileges when generating a support file. This issue impacts: Cortex XDR agent 5.0 versions earlier than...
Information Disclosure
shelljs is vulnerable to information disclosure. The vulnerability exists in ShellJS exec function of exec.js because the file permissions have not been locked down which allows an attacker to gain access to sensitive information of file system of the running scripts and crash application...
Information Disclosure
@replit/crosis is vulnerable to information disclosure. The vulnerability exists due to the exposure of sensitive information, multiple communication failed attempts to Replit, allowing an attacker to access the previous URL and retrieve the same destination without permission...
Google Android 安全漏洞
Google Android is a Linux-based open source operating system from Google, Inc. Google Android has a security vulnerability that originates from System 10 in Google Android 11. An attacker could use the vulnerability to obtain sensitive information...
PYSEC-2021-858
This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends result stores. When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery...
Security feature bypass
Incorrect permission assignment for critical resource vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows a remote unauthenticated attacker to access arbitrary files on the server and obtain...
