CVE-2025-4088

A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any site that had invoked the Storage Access API. This enabled potential Cross-Site Request Forgery attacks across origins. This vulnerability affects Firefox 1...

CVE-2025-4088 Cross-site request forgery via storage access API redirects

A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any site that had invoked the Storage Access API. This enabled potential Cross-Site Request Forgery attacks across origins. This vulnerability was fixed in...

CVE-2025-4088

A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any site that had invoked the Storage Access API. This enabled potential Cross-Site Request Forgery attacks across origins. This vulnerability was fixed in...

Astra Linux – Vulnerability in pgpool2

Information disclosure vulnerabilities exist in Pgpool-II versions 4.4.0 to 4.4.1 4.4 series, 4.3.0 to 4.3.4 4.3 series, 4.2.0 to 4.2.11 4.2 series, 4.1.0 to 4.1.14 4.1 series, 4.0.0 to 4.0.21 4.0 series, all versions of the 3.7 series, all versions of the 3.6 series, all versions of the 3.5...

Apple iTunes < 12.13.3 Multiple Vulnerabilities (credentialed check)

The version of Apple iTunes installed on the remote Windows host is prior to 12.13.3. It is, therefore, affected by multiple vulnerabilities as referenced in the 121328 advisory. - A stack buffer overflow was addressed through improved input validation. This issue is fixed in Apple TV 1.5.0.152 f...

PT-2024-28749 · Dahua · Dahua

Name of the Vulnerable Software and Affected Versions: Dahua products affected versions not specified Description: A vulnerability has been found in Dahua products. After obtaining an ordinary user's username and password, the attacker can send a carefully crafted data packet to the interface wit...

Apple iTunes < 12.13.2 A Vulnerability (credentialed check)

The version of Apple iTunes installed on the remote Windows host is prior to 12.13.2. It is, therefore, affected by a vulnerability as referenced in the HT214099 advisory. - The issue was addressed with improved checks. This issue is fixed in iTunes 12.13.2 for Windows. Parsing a file may lead to...

CVE-2024-26258

OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with credentials to execute arbitrary OS commands by sending a specially crafted request to the product...

CVE-2024-24301

Command Injection vulnerability discovered in 4ipnet EAP-767 device v3.42.00 within the web interface of the device allows attackers with valid credentials to inject arbitrary shell commands to be executed by the device with root privileges...

CVE-2023-52324: Unrestricted Upload of File with Dangerous Type

An unrestricted file upload vulnerability in Trend Micro Apex Central could allow a remote attacker to create arbitrary files on affected installations. Please note: although authentication is required to exploit this vulnerability, this vulnerability could be exploited when the attacker has any...

Exploit for Injection in Hyland Alfresco_Content_Services

CVE-2023-49964: FreeMarker Server-Side Template Injection in A...

CVE-2023-4828

An improper check for an exceptional condition in the Insider Threat Management ITM Server could be used by an attacker to change the server's configuration of any already-registered agent so that the agent sends all future communications to an attacker-chosen URL. This could result in disclosure...

CVE-2023-34923: Incorrect Authorization

XML Signature Wrapping XSW in SAML-based Single Sign-on feature in TOPdesk v12.10.12 allows bad actors with credentials to authenticate with the Identity Provider IP to impersonate any TOPdesk user via SAML Response manipulation...

CSRF vulnerability and missing permission checks in octoperf

octoperf 4.5.2 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to a previously configured Octoperf server using attacker-specified credentials. Additionally, these endpoints do not require POST requests,...

CVE-2022-4313

A vulnerability was reported where through modifying the scan variables, an authenticated user in Tenable products, that has Scan Policy Configuration roles, could manipulate audit policy variables to execute arbitrary commands on credentialed scan targets...

Code injection

A vulnerability was reported where through modifying the scan variables, an authenticated user in Tenable products, that has Scan Policy Configuration roles, could manipulate audit policy variables to execute arbitrary commands on credentialed scan targets...

CVE-2022-4313

A vulnerability was reported where through modifying the scan variables, an authenticated user in Tenable products, that has Scan Policy Configuration roles, could manipulate audit policy variables to execute arbitrary commands on credentialed scan targets...

PT-2023-14178 · Tenable · Tenable

Name of the Vulnerable Software and Affected Versions: Tenable products affected versions not specified Description: A vulnerability was reported where an authenticated user with Scan Policy Configuration roles in Tenable products could manipulate audit policy variables by modifying the scan...

Tenable Network Security Tenable.Sc和Nessus 安全漏洞

Tenable Network Security Nessus and Tenable.Sc are both products of Tenable Network Security, U.S.A. Nessus is an open-source system vulnerability scanner.Tenable.Sc is a vulnerability analysis solution. Sc is a vulnerability analysis solution that supports real-time vulnerability assessment and...

SUSE CVE-2015-7184

The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin...