721 matches found
Path traversal
An external control of path and data vulnerability in the Palo Alto Networks PAN-OS Panorama XSLT processing logic that allows an unauthenticated user with network access to PAN-OS management interface to write attacker supplied file on the system and elevate privileges. This issue affects: All...
makestickers.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1159757 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
Attack Against PC Thunderbolt Port
The attack requires physical access to the computer, but it's pretty devastating: On Thunderbolt-enabled Windows or Linux PCs manufactured before 2019, his technique can bypass the login screen of a sleeping or locked computer -- and even its hard disk encryption -- to gain full access to the...
CVE-2020-10685
A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchiv...
Oracle Supply Chain Products Suite Agile PLM Unauthorized Access Vulnerability
Oracle Supply Chain Products Suite is a set of supply chain solutions from Oracle USA. The product provides value chain planning, value chain execution, product lifecycle management, etc. Agile PLM Product Lifecycle Management is one of the product lifecycle management components. A security...
sizemometer (>=0.3.0 <=0.8.1) potentially affected by CVE-2020-7619 via get-git-data (>=1.3.0 <=1.3.1)
get-git-data NPM version =1.3.0, =0.3.0, =0.8.1 Source cves: CVE-2020-7619 Source advisory: SNYK:JS-GETGITDATA-564222...
kodomoe.net Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1126323 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
Drupal Data SQL Injection Vulnerability
Drupal is an open source content management system developed by the Drupal community using the PHP language. A SQL injection vulnerability exists in Drupal version 6.20, Data 6.x-1.0-alpha14. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based...
The vulnerability of Intel processors, caused by data leakage from the L1D cache, allows attackers to disclose protected information.
The vulnerability of Intel processors stems from a data leak from the L1D cache. Exploiting this vulnerability can allow an attacker to disclose protected information...
millennium.calltrack.co Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1067021 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
SUSE-SU-2020:14267-1 Security update for log4j
This update for log4j fixes the following issues: - CVE-2019-17571: Fixed a remote code execution by deserialization of untrusted data in SocketServer bsc1159646...
Race condition
In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted such as by a timeout would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition...
Cross site scripting
The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting XSS. It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of...
fortmorgancharterboats.vidmy.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1017093 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting...
Design/Logic Flaw
A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...
thomka.meck.hu Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-979218 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
Atlassian JIRA < 8.4.0 SSRF
Binary data 701221.prm...
First American Financial Corp. Data Records Leak
Krebs on Security is reporting a massive data leak by the real estate title insurance company First American Financial Corp. "The title insurance agency collects all kinds of documents from both the buyer and seller, including Social Security numbers, drivers licenses, account statements, and eve...
Fortinet FortiClient 6.2.x < 6.2.1 Missing Encryption Of Sensitive Data Vulnerability
The version of Fortinet FortiClient running on the remote host is prior to 6.2.1. It is, therefore, affected by a missing encryption of sensitive data vulnerability. An attacker can access VPN session cookie from an endpoint device running FortiClient. The attacker can steal the cookies only if...
CVE-2019-7611
A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the aliases, shrink, or split endpoints are used . If the elasticsearch.yml file has xpack.security.dlsfls.enabled set to false, certain permission...