3016 matches found
GHSA-24Q2-59HM-RH9R Strapi Improper Rate Limiting vulnerability
Summary There is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. 2. Details It is possible to avoid this by modifying the rate-limited request path as follows. 1. Manipulating request paths to upper or lower case. Pattern 1 - In this case,...
Ocean Extra Plugin for WordPress < 2.6.5 Insecure Deserialization
The WordPress Ocean Extra Plugin installed on the remote host is affected by an Insecure Deserialization during file import. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...
GHSA-4CPV-669C-R79X Prevent injection of invalid entity ids for "autocomplete" fields
Impact Under certain circumstances, an attacker could successfully submit an entity id for an EntityType that is not part of the valid choices. Affected applications are any that use: A custom querybuilder option to limit the valid results; AND An EntityType with 'autocomplete' = true or a custom...
Oracle Linux 8 : pki-core:10.6 / and / pki-deps:10.6 (ELSA-2020-1644)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1644 advisory. - A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a...
CVE-2023-38463
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges...
CVE-2023-38451
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges...
CVE-2023-38459
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges...
CVE-2023-38453
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges...
CVE-2023-38465
In ims service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges...
CVE-2023-38457
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges...
CVE-2023-38437
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges...
CVE-2023-38445
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges...
CVE-2023-38446
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges...
CVE-2023-38440
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges...
CVE-2023-33918
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges...
CVE-2023-38441
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges...
CVE-2023-38442
In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges...
PT-2023-26422 · Unknown · Vowifiservice
Name of the Vulnerable Software and Affected Versions: vowifiservice affected versions not specified Description: The issue is related to a possible missing permission check in vowifiservice. This could lead to local information disclosure with no additional execution privileges. Recommendations:...
Arbitrary Code Injection
github.com/ansible-semaphore/semaphore is vulnerable to Arbitrary Code Injection. The vulnerability exists in makeCmd function at AnsiblePlaybook.go which allows a remote attacker to execute arbitrary code via a crafted payload to the extra variables parameter...