763 matches found
Moxa EDS-4000/G4000 Series Initialization of a Resource with an Insecure Default (CVE-2024-0387)
The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to the product and have it forwarded to the target. An attacker can bypass access controls or hide the source of malicious requests. This plugi...
CVE-2025-0796
The Mortgage Lead Capture System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.2.10. This is due to missing or incorrect nonce validation on the 'wprequalresetdefaults' action. This makes it possible for unauthenticated attackers to reset...
PT-2025-6800 · WordPress · Mortgage Lead Capture System
Name of the Vulnerable Software and Affected Versions: Mortgage Lead Capture System plugin for WordPress versions up to, and including, 8.2.10 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the wprequal reset defaults action. This...
CVE-2024-3220 Default mimetype known files writeable on Windows
There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the...
@adhawk/analytics-pixel-loader (>=0.0.2, <=2.0.2), @adhawk/analytics.js-integration-freshdesk (0.1.0) +141 more potentially affected by CVE-2024-57066 via @ndhoule/defaults (2.0.1)
@ndhoule/defaults NPM version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @ndhoule/defaults and may be impacted: - @adhawk/analytics-pixel-loader =0.0.2, =1.2.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.0.0, =0.1.0, =1.0.0, =1.1.0 -...
CVE-2024-57066
CVE-2024-57066 targets the @ndhoule/defaults library. The root cause is a prototype pollution in the lib.deep function of v2.0.1, allowing crafted payloads to trigger a Denial of Service (DoS). Public documentation consistently links this to a DoS vector with network access and no user interactio...
CVE-2024-57066
A prototype pollution in the lib.deep function of @ndhoule/defaults v2.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...
PT-2025-5766 · Npm · @Ndhoule/Defaults
Name of the Vulnerable Software and Affected Versions: @ndhoule/defaults version 2.0.1 Description: A prototype pollution in the lib.deep function allows attackers to cause a Denial of Service DoS via supplying a crafted payload. Recommendations: For @ndhoule/defaults version 2.0.1, consider...
defaults 安全漏洞
defaults is a library by the individual developer Nathan Houle. When the value of an enumerable property owned on a source object is undefined, copying that property from the source object to the target object A security vulnerability exists in defaults version v2.0.1, which stems from the lib.de...
GHSA-29QP-CRVH-W22M Withdrawn Advisory: github.com/hashicorp/yamux's DefaultConfig has dangerous defaults causing hung Read
Withdrawn Advisory This advisory has been withdrawn because further research determined that github.com/hashicorp/yamux was not vulnerable to denial of service in the manner described. This link is maintained to preserve external references. Original Description The default values for...
Smiths Detection HI-SCAN 6040i Hitrax HX-03-19-I 安全漏洞
The Smiths Detection HI-SCAN 6040i Hitrax HX-03-19-I is an entry-level X-ray equipment electronic component from Smiths Detection, UK. A security vulnerability exists in the Smiths Detection HI-SCAN 6040i Hitrax HX-03-19-I that stems from an insecure default configuration that allows an...
Vulnerabilities fixed in Rockwell Automation Power Monitor 1000
Rockwell Automation has fixed vulnerabilities in the Power Monitor 1000. The vulnerabilities are in the API of the Power Monitor 1000, which allows unauthorized users to configure new Policyholder users with high privileges. This allows attackers to edit existing users, create new administrators...
PT-2024-36564 · Kanboard +1 · Kanboard +1
Name of the Vulnerable Software and Affected Versions: Kanboard versions prior to 1.2.43 Description: Kanboard is project management software that focuses on the Kanban methodology. In affected versions, sessions are still usable even though their lifetime has exceeded. Kanboard implements a cust...
The vulnerability of Remote Desktop Services (RDS) for Windows operating systems allows a hacker to execute arbitrary code.
The vulnerability of Remote Desktop Services RDS for Windows operating systems lies in the default insecure initialization of certain variables. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2024-51554
Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02...
Red Hat Keycloak 信任管理问题漏洞
Red Hat Keycloak is a suite of software from Red Hat USA that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak that stems from sensitive data being embedded as a default value in bytecode or environment...
Google Firebase Js Sdk 安全漏洞
Google Firebase Js Sdk is a client-side codebase for connecting to Firebase back-end services from Google, Inc USA. A security vulnerability exists in Google Firebase Js Sdk that stems from the use of a cookie named FIREBASEDEFAULTS to store configuration data, which allows an attacker to capture...
Insyde InsydeH2O 安全漏洞
Insyde InsydeH2O is a new EFI/UEFI specification from Insyde China. It is intended to replace the traditional BIOS Basic Input/Output System. A security vulnerability exists in Insyde InsydeH2O, which stems from a 0x49 function that can restore the factory default settings of certain UEFI variabl...
kernel: serial: 8250: Reinit port->pm on port specific driver unbind
In the Linux kernel, the following vulnerability has been resolved: serial: 8250: Reinit port-pm on port specific driver unbind When we unbind a serial port hardware specific 8250 driver, the generic serial8250 driver takes over the port. After that we see an oops about 10 seconds later. This can...