4845 matches found
Design/Logic Flaw
orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...
USN-6658-1: libxml2 vulnerability
It was discovered that libxml2 incorrectly handled certain XML documents. A remote attacker could possibly use this issue to cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary code...
AnythingLLM Security Vulnerability
AnythingLLM is a business-compliant document chatbot. A security vulnerability exists in AnythingLLM that originates from a user with default privileges being able to delete documents uploaded by an administrator through certain actions...
AnythingLLM Security Vulnerability
AnythingLLM is a business-compliant document chatbot. AnythingLLM has a security vulnerability that stems from the lack of any validation and is capable of including malicious links into submitted document links in the workspace...
CVE-2024-27454
orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...
PT-2024-15831 · Unknown · Mintplex-Labs/Anything-Llm
Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm affected versions not specified Description: A privilege escalation issue exists, allowing users with the default role to delete documents uploaded by the admin. This is due to improper access control checks, enabli...
CVE-2024-24681
An issue was discovered in Yealink Configuration Encrypt Tool AES version and Yealink Configuration Encrypt Tool RSA version before 1.2. There is a single hardcoded key used to encrypt provisioning documents across customers' installations...
CVE-2024-24681
An issue was discovered in Yealink Configuration Encrypt Tool AES version and Yealink Configuration Encrypt Tool RSA version before 1.2. There is a single hardcoded key used to encrypt provisioning documents across customers' installations...
CVE-2024-24681: Use of Hard-coded Credentials
An issue was discovered in Yealink Configuration Encrypt Tool AES version and Yealink Configuration Encrypt Tool RSA version before 1.2. There is a single hardcoded key used to encrypt provisioning documents across customers' installations...
CVE-2024-24681
An issue was discovered in Yealink Configuration Encrypt Tool AES version and Yealink Configuration Encrypt Tool RSA version before 1.2. There is a single hardcoded key used to encrypt provisioning documents across customers' installations...
Liferay Portal and Liferay DXP Security Vulnerabilities
Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...
Yealink Configuration Encrypt Tool Static AES Key
CloudAware Security Advisory CVE-2024-24681: Insecure AES key in Yealink Configuration Encrypt Tool ======================================================================== Summary ======================================================================== A single, vendorwide, hardcoded AES key in...
PT-2024-20489
Name of the Vulnerable Software and Affected Versions Yealink Configuration Encrypt Tool versions prior to 1.2 Yealink Configuration Encrypt Tool RSA version affected versions not specified Description An issue was discovered in the Yealink Configuration Encrypt Tool where a single hardcoded key ...
CVE-2023-37495 HCL Domino is susceptible to a weak cryptography vulnerability
Internet passwords stored in Person documents in the Domino® Directory created using the "Add Person" action on the People & Groups tab in the Domino® Administrator are secured using a cryptographically weak hash algorithm. This could enable attackers with access to the hashed value to determine ...
CVE-2024-1349: Improper Neutralization of Input During Web Page Generation
The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.9.8 due to insufficient input...
PT-2024-12626 · Domino · Domino
Name of the Vulnerable Software and Affected Versions: Domino affected versions not specified Description: The issue is related to the use of a cryptographically weak hash algorithm to secure internet passwords stored in Person documents in the Domino Directory. This weakness could allow attacker...
The vulnerability of the devices/vector/gdevtxtw.c component of the software for processing, transforming, and generating Ghostscript documents allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the devices/vector/gdevtxtw.c component of the software for processing, transforming, and generating Ghostscript documents is related to an incorrect definition of the size of the buffer space that is freed during operation. Exploiting this vulnerability could allow a malicio...
Chinese Hackers Using Deepfakes in Advanced Mobile Banking Malware Attacks
A Chinese-speaking threat actor codenamed GoldFactory has been attributed to the development of highly sophisticated banking trojans, including a previously undocumented iOS malware called GoldPickaxe that's capable of harvesting identity documents, facial recognition data, and intercepting SMS...
CVE-2024-0248
The EazyDocs WordPress plugin before 2.4.0 re-introduced CVE-2023-6029 https://wpscan.com/vulnerability/7a0aaf85-8130-4fd7-8f09-f8edc929597e/ in 2.3.8, allowing any authenticated users, such as subscriber to delete arbitrary posts, as well as add and delete documents/sections. The issue was...
CVE-2024-0248
The EazyDocs WordPress plugin before 2.4.0 re-introduced CVE-2023-6029 https://wpscan.com/vulnerability/7a0aaf85-8130-4fd7-8f09-f8edc929597e/ in 2.3.8, allowing any authenticated users, such as subscriber to delete arbitrary posts, as well as add and delete documents/sections. The issue was...