Insecure Access Control

github.com/pterodactyl/wings allows insecure access to endpoints. An attacker is able to access resources on local networks that would otherwise be inaccessible due to lack of hostname verification...

The vulnerability of the software for implementing the hypertext environment MediaWiki allows a perpetrator to compromise the confidentiality of the protected information.

The vulnerability of the software for implementing the hypertext environment MediaWiki arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious individual to compromise the confidentiality of the protected information due to...

XSS vulnerability in bludit-cms

bludit-cms is a flat file content management system. An XSS vulnerability exists in bludit-cms, which can be exploited by an attacker to obtain sensitive information such as user cookies...

The vulnerability of Trend Micro Deep Security Agent lies in its improper handling of links before accessing a file. This allows attackers to delete any files they desire.

The vulnerability of the Trend Micro Deep Security Agent lies in the improper handling of links before accessing a file. Exploiting this vulnerability could allow an attacker to delete any files they desire...

CVE-2021-27487

ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext. This could allow an attacker to gain access to sensitive information...

Hardcoded credentials

ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products utilize an encryption key in the data exchange process, which is hardcoded. This could allow an attacker to gain access to sensitive information...

CVE-2021-27487

ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext. This could allow an attacker to gain access to sensitive information...

The vulnerability of the online business analytics service IBM Cognos Analytics, related to the leakage of information in error messages, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the online business analytics service IBM Cognos Analytics is related to the leakage of information in error messages. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2021-27637

Under certain conditions SAP Enable Now SAP Workforce Performance Builder - Manager, versions - 1.0, 10 allows an attacker to access information which would otherwise be restricted leading to information disclosure...

CVE-2021-33662

Under certain conditions, the installation of SAP Business One, version - 10.0, discloses sensitive information on the file system allowing an attacker to access information which would otherwise be restricted...

Nuvoton NPCT 安全漏洞

Intel Nuvoton Consumer Infrared CIR Driver is an infrared driver from Intel Corporation USA. A security vulnerability in the Nuvoton NPCT75x TPM 1.2 firmware version 7.4.0.0, which stems from incorrect access control, allows a highly privileged, locally authenticated attacker to gain unauthorized...

Citrix Cloud Connector 安全漏洞

Citrix Systems Citrix Cloud Connector is a Citrix component from Citrix Systems, Inc. that serves as a communication channel between Citrix Cloud and your resource locations, enabling cloud management without any complex network or infrastructure configuration. A security vulnerability exists in...

Crocus has an unauthorized access vulnerability

Crocus is an energy data analytics platform. An unauthorized access vulnerability exists in Crocus. An attacker can use the vulnerability to bypass permission determination to access functional pages...

Design/Logic Flaw

An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift. This flaw allows an attacker with access to a running container which mounts /etc/kubernetes or has local access to the node, to copy this kubeconfig file and attempt to add their own node to the OpenShif...

Authentication Bypass

github.com/kiali/kiali is vulnerable to authentication bypass. When RBAC is disabled, the token validation in the authentication strategy OpenID does not occur and allows an attacker to bypass authentication...

FortiAuthenticator - Hard-coded cryptographic keys used to encrypt sensitive data

Usage of hard-coded cryptographic keys to encrypt configuration files and debug logs in FortiAuthenticator may allow an attacker with access to the files or the CLI configuration to decrypt the sensitive data, via knowledge of the hard-coded key...

Nokia 6.2 suffers from an information disclosure vulnerability

Nokia 6.2 is a smartphone. Nokia 6.2 suffers from an information disclosure vulnerability. An attacker can exploit the vulnerability to obtain sensitive information...

General Mobile GM8 suffers from an information disclosure vulnerability

General Mobile is a Turkish smartphone manufacturer. An information disclosure vulnerability exists in General Mobile GM8. An attacker could exploit the vulnerability to obtain sensitive information...

Design/Logic Flaw

A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler. An attacker with access to create VMs could attach any secret within their namespace, allowing them to read the contents of that secret...

CVE-2020-10695

An insecure modification flaw in the /etc/passwd file was found in the redhat-sso-7 container. An attacker with access to the container can use this flaw to modify the /etc/passwd and escalate their privileges...