1225 matches found
The vulnerability of the SMB2 packet signing mechanism in the Samba networking communication software allows a attacker to execute a type of “man-in-the-middle” attack.
The vulnerability of the SMB2 packet signing mechanism in the Samba network communication software is related to insufficient verification of data authenticity. Exploiting this vulnerability allows a malicious actor to act remotely...
MikroTik RouterOS Insufficient Verification of Data Authenticity (CVE-2019-3979)
RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below are vulnerable to a DNS unrelated data attack. The router adds all A records to its DNS cache even when the records are unrelated to the domain that was queried. Therefore, a remote attacker controlled DNS server can poison the router's...
Cross-Site Request Forgery (CSRF)
decidim-templates is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to the CSRF authenticity token check being disabled for the questionnaire templates preview. This flaw allows attackers to gain access to information which was not meant to be public...
CVE-2023-47635
Decidim is a participatory democracy framework. Starting in version 0.23.0 and prior to versions 0.27.5 and 0.28.0, the CSRF authenticity token check is disabled for the questionnaire templates preview. The issue does not imply a serious security thread as you need to have access also to the...
GHSA-F3QM-VFC3-JG6V Possible CSRF attack at questionnaire templates preview
Impact The CSRF authenticity token check is currently disabled for the questionnaire templates preview as per: https://github.com/decidim/decidim/blob/3187bdfd40ea1c57c2c12512b09a7fec0b2bed08/decidim-templates/app/controllers/decidim/templates/admin/questionnairetemplatescontroller.rbL11 This was...
Possible CSRF attack at questionnaire templates preview
Impact The CSRF authenticity token check is currently disabled for the questionnaire templates preview as per: https://github.com/decidim/decidim/blob/3187bdfd40ea1c57c2c12512b09a7fec0b2bed08/decidim-templates/app/controllers/decidim/templates/admin/questionnairetemplatescontroller.rbL11 This was...
Server-Side Request Forgery (SSRF)
Overview decidim-templates is a This module provides a solution to create templates for different Decidim models, such as Proposals and Questionnaires. Affected versions of this package are vulnerable to Server-Side Request Forgery SSRF due to the authenticity token check being disabled for the...
CVE-2023-47635 Decidim vulnerable to possible CSRF attack at questionnaire templates preview
Decidim is a participatory democracy framework. Starting in version 0.23.0 and prior to versions 0.27.5 and 0.28.0, the CSRF authenticity token check is disabled for the questionnaire templates preview. The issue does not imply a serious security thread as you need to have access also to the...
CVE-2023-47635 Decidim vulnerable to possible CSRF attack at questionnaire templates preview
Decidim is a participatory democracy framework. Starting in version 0.23.0 and prior to versions 0.27.5 and 0.28.0, the CSRF authenticity token check is disabled for the questionnaire templates preview. The issue does not imply a serious security thread as you need to have access also to the...
CVE-2023-47635
CVE-2023-47635 concerns Decidim (Ruby on Rails) where the CSRF authenticity token check is disabled for the questionnaire templates preview in versions ≤ 0.27.4 and 0.28.0 before the fix. The risk is limited by the requirement that an attacker must also access the user session cookie to view the ...
Possible CSRF attack at questionnaire templates preview
Impact The CSRF authenticity token check is currently disabled for the questionnaire templates preview as per: https://github.com/decidim/decidim/blob/3187bdfd40ea1c57c2c12512b09a7fec0b2bed08/decidim-templates/app/controllers/decidim/templates/admin/questionnairetemplatescontroller.rbL11 This was...
CVE-2023-20576
A vulnerability was found in AMD hardware due to insufficient verification of data authenticity in AGESA. This issue may allow a local unauthenticated attacker to update SPI ROM data, potentially resulting in denial of service or privilege escalation. Mitigation Mitigation for this issue is eithe...
Paving a Path to Systems Administration: Naeem Jones’ Journey with Rapid7
Prior to becoming a Systems Administrator at Rapid7, Naeem Jones entered his career in cybersecurity through the Hack. Diversity program. Hack.Diversity is a program that connects talented Black and Latin/x students and early-career professionals with organizations that are looking to build...
The vulnerability of the XWiki Admin Tools application on the XWiki Platform. XWiki is a platform for creating collaborative web applications. This vulnerability allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the XWiki Admin Tools application in the XWiki platform involves insufficient verification of the authenticity of executed queries. Exploiting this vulnerability could allow a malicious actor, operating remotely, to compromise the confidentiality, integrity, and accessibility...
The vulnerability of the Postscript File Handler component in Lexmark’s microprogramming printing software allows a hacker to execute arbitrary code.
The vulnerability of the Postscript File Handler component in Lexmark’s microprogramming printing software exists due to the lack of authenticity checks before access to functions is granted. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
The vulnerability of the XWiki platform for creating collaborative web applications lies in the insufficient verification of the authenticity of executed queries. This allows attackers to obtain the rights of the current user.
The vulnerability of the XWiki Platform lies in the insufficient verification of the authenticity of executed queries. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain the privileges of the current user through a specially created URL...
Authorization
Insufficient verification of data authenticity in the configuration state machine may allow a local attacker to potentially load arbitrary bitstreams...
CVE-2023-20570
The CVE-2023-20570 entry relates to AMD UltraScale/UltraScale+ FPGA devices. The vulnerability stems from insufficient verification of data authenticity in the configuration state machine, which could allow a local attacker to load arbitrary bitstreams. The affected component is the configuration...