326 matches found
CVE-2022-29199
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.rawops.LoadAndRemapMatrix does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack. Th...
Owncloud ownCloud 安全漏洞
Owncloud ownCloud is a personal cloud storage solution from the American company ownCloud Owncloud. There is a security vulnerability in Owncloud owncloud, there is no information about the vulnerability at the moment, please stay tuned to CNNVD or the vendor's announcement...
Design/Logic Flaw
CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the response header 'X-CFY-TX-TM'. In certain configurations, that response header contains different, predictable value ranges which can be used to determine whether a user exists in the tenant...
CVE-2022-22700
CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the response header 'X-CFY-TX-TM'. In certain configurations, that response header contains different, predictable value ranges which can be used to determine whether a user exists in the tenant...
Local Privilege Escalation in polkits pkexec
A bug exists in the polkit pkexec binary in how it processes arguments. If the binary is provided with no arguments, it will continue to process environment variables as argument variables, but without any security checking. By using the execve call we can specify a null argument list and populat...
CVE-2021-43853
Ajax.NET Professional AjaxPro is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation...
PT-2021-11526 · Hewlett Packard · Laserjet Managed Mfp E62665 Firmware +195
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue allows for arbitrary code execution during installation with certain driver software or application packages. Recommendations: At the moment,...
PT-2021-4440 · Microsoft · Windows Media Audio Decoder +1
Name of the Vulnerable Software and Affected Versions: Windows Media Audio Decoder affected versions not specified Description: The issue is related to errors in code generation management in the Windows Media Audio Decoder. It allows remote attackers to execute arbitrary code and affect the...
3S-Smart Software Solutions CODESYS V3 web server 安全漏洞
3s-smart Software Solutions 3S-Smart Software Solutions CODESYS V3 web server is a web server from 3S-Smart Software Solutions Germany that is used in the CODESYS product. 3S-Smart Software Solutions CODESYS V3 web server is a web server used by 3S-Smart Software Solutions 3s-smart Software...
IBM Security Identity Manager 安全漏洞
IBM Security Identity Manager ISIM is a suite of identity management and governance solutions from IBM in the United States. The solution automates the creation, modification, re-authentication and termination of user privileges throughout the user lifecycle and supports policy-based password...
PT-2021-10672
Name of the Vulnerable Software and Affected Versions: GNU LibreDWG version 0.10.2641 Description: A null pointer dereference issue exists, which causes a denial of service, resulting in an application crash. The issue is related to the htmlescape function in the escape.c file. Recommendations: F...
Code injection
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Special:Contributions can leak that a "hidden" user exists...
Denial of service
The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a group exists & members of groups if they are assigned to publicly...
DEBIAN-CVE-2020-35518
When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database...
PT-2021-17743 · Netflix · Netflix Oss Hollow
Name of the Vulnerable Software and Affected Versions: Netflix OSS Hollow affected versions not specified Description: The issue allows an attacker to pre-create directories with wide permissions since the Files.existsparent check is performed before creating the directories. Furthermore, the use...
CVE-2019-14476
AdRem NetCrunch 10.6.0.4587 has a Server-Side Request Forgery SSRF vulnerability in the NetCrunch server. Every user can trick the server into performing SMB requests to other systems...
Denial of Service Vulnerability in Flash Art App
Flash Art APP is a collection of a large number of high-quality original novel reading software. A denial of service vulnerability exists in Flash Art APP, which can be exploited by attackers to cause a denial of service...
daylight-online.ch Cross Site Scripting vulnerability OBB-1219345
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
IBM InfoSphere Information Server Cross-Site Request Forgery Vulnerability (CNVD-2020-31093)
IBM InfoSphere Information Server is a set of data integration platforms from IBM in the United States. The platform can be used to integrate data information obtained from various sources. A cross-site request forgery vulnerability exists in IBM InfoSphere Information Server. An attacker could...