13124 matches found
CVE-2023-5702
CVE-2023-5702 affects Viessmann Vitogate 300 up to version 2.1.3.0. A vulnerability in an unspecified function of the /cgi-bin/ path allows a direct request that can be leveraged by an attacker; public exploit/PoC information exists (e.g., exploitation described in exploitDB). Red Hat and ICS adv...
Viessmann Vitogate Security Breach
Viessmann Vitogate is an intelligent control system from Viessmann. A security vulnerability exists in Viessmann Vitogate versions 300 through 2.1.3.0, which stems from the presence of some unknown functions in /cgi-bin/, resulting in a direct request...
WordPress wpDiscuz Plugin <= 7.6.3 is vulnerable to Insecure Direct Object References (IDOR)
Software wpDiscuz Type Plugin Vulnerable versions = 7.6.3 Fixed in 7.6.4 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-46311 Patch priority Low CVSS severity Low 2.7 Developer Claim ownership PSID 05932cb617e2 Credits Revan Arifio Requir...
Insufficient validation of contracts when setting authorised address.
Lines of code Vulnerability details Impact governance can set Malicious contract as authorised address and since the AddressProvider.sol is a singular source of truth an attacker can craft an exploit to abuse authorizedAddress privileges. Proof of Concept A miniaturised POC is shown below. in the...
PYSEC-2023-219
Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any change...
CVE-2023-45809 Disclosure of user names via admin bulk action views in wagtail
Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any change...
Snapshot fuzzing direct composition with WTF
Cisco Talos has developed a custom fuzzer using the popular snapshot fuzzer "WTF" which targets Direct Composition in Windows. Talos vulnerability research team used Protocol Buffers developed by Google to serialize and deserialize test cases. The Bochscpu backend of WTF was patched and other...
The vulnerability of SIMATIC CP communication module software, related to insufficient access control for DMA memory, allows a intruder to cause a service failure.
The vulnerability of the microprogramming software for SIMATIC CP communication modules is related to insufficient access control for DMA memory. Exploiting this vulnerability could allow an intruder to cause a service failure...
Lost and Found Information System security breach
Lost and Found Information System is a lost and found information system by oretnom23 Individual Developer. A security vulnerability exists in version 1.0 of the Lost and Found Information System, which stems from an insecure direct object reference vulnerability in the system that allows account...
SUSE CVE-2023-32724
Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation...
Incorrect Authorization
Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Incorrect Authorization through the V1/customers/me endpoint. An attacker can achieve information exposure and privilege escalation by triggering an insecure direct object...
DEBIAN-CVE-2023-32724
Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation...
CVE-2023-32724
Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation...
CVE-2023-32724
Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation...
CVE-2023-32724
Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation...
Design/Logic Flaw
Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation...
UBUNTU-CVE-2023-32724
Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation...
CVE-2023-32724
CVE-2023-32724 concerns Zabbix’s use of the Duktape JavaScript engine, where a memory pointer is exposed via a Ducktape object property, enabling direct memory access/manipulation. The connected sources confirm this affects Zabbix frontend/backend components relying on Duktape, with potential hig...
CVE-2023-32724 JavaScript engine memory pointers are directly available for Zabbix users for modification
Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation...
