109 matches found
libreswan: IKEv1 default AH/ESP responder can crash and restart
A flaw was found in Libreswan, where it was identified to contain an assertion failure issue in the computeprotokeymat function. The vulnerability can be exploited when an IKEv1 connection is loaded with an AH/ESP default setting when no esp= line is present in the connection. This flaw allows an...
PT-2024-12231 · Openwrt · Openwrt
Name of the Vulnerable Software and Affected Versions: OpenWrt versions 18.06 through 22.03 and beyond Description: An issue in OpenWrt allows off-path attackers to hijack TCP sessions. This could lead to a denial of service, impersonating the client to the server, and impersonating the server to...
Mozilla: IndexedDB files retained in private browsing mode
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: If the browser.privatebrowsing.autostart preference is enabled, IndexedDB files were not properly deleted when the window was closed. This preference is disabled by default in Firefox...
Mozilla: IndexedDB files retained in private browsing mode
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: If the browser.privatebrowsing.autostart preference is enabled, IndexedDB files were not properly deleted when the window was closed. This preference is disabled by default in Firefox...
Remote Code Execution (RCE)
pdfjs-dist is vulnerable to Remote Code Execution RCE. The vulnerability is due to the default setting isEvalSupported set to true, which allows unrestricted execution of attacker-controlled JavaScript within the hosting domain context...
Updated less packages fix security vulnerability
less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the...
BIT-AIRFLOW-2020-13927
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at...
BIT-ELASTICSEARCH-2021-22146
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and is unable to successfully query any Elasticsearch APIs, an attacker could leverage the anonymous user to...
Apache Spark < 3.4.0 Privilege Escalation (CVE-2023-22946)
In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This...
PaperCut NG Authorization Issues Vulnerability
PaperCut NG is a suite of next-generation printer control software from PaperCut Australia. An authorization issue vulnerability exists in PaperCut NG versions 22.0.12 and earlier, which stems from a default that allows unauthenticated XMLRPC commands to be run...
CVE-2023-40708 Improper Access Control in OPTO 22 SNAP PAC S1
The File Transfer Protocol FTP port is open by default in the SNAP PAC S1 Firmware version R10.3b. This could allow an adversary to access some device files...
CVE-2023-4413
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Permission to access the file is limited to administrative users only by default...
Improper Header Validation
libopendkim.so is vulnerable to Improper Header Validation. The vulnerability exists due to the default setting used for the KeepAuthResults parameter in opendkim.c, which fails to keep track of ordinal numbers when removing fake Authentication-Results header fields, allowing an attacker to send...
CVE-2023-22451 Weak password requirements in Kiwi TCMS
Kiwi TCMS is an open source test management system. In version 11.6 and prior, when users register new accounts and/or change passwords, there is no validation in place which would prevent them from picking an easy to guess password. This issue is resolved by providing defaults for the...
PT-2025-54168
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to interrupt request IRQ handling on the arm64 architecture. Specifically, the filter irq stacks function, intended to filter IRQ-related entries...
GHSA-CH4C-278Q-5654 rdiffweb Missing Custom Error Page
rdiffweb version 2.4.1 is set to a default and leaks error information. Version 2.4.2 fixes this issue...
DRUPAL-CORE-2022-012
In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However,...
PT-2022-14082 · Unknown +3 · Gnome-Control-Center +3
Name of the Vulnerable Software and Affected Versions: gnome-control-center affected versions not specified Description: The issue concerns the configuration of gnome-control-center in Ubuntu, which allowed Remote Desktop Sharing to be enabled by default. Additionally, turning off RDP Remote...
Sassy Social Share < 3.3.40 - Reflected Cross-Site Scripting
The plugin does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled which is the default setting, leading to a Reflected Cross-Site Scripting issue. Note: Vendor was notified on September 14th, 2021. PoC...
