5480 matches found
CVE-2021-38458
creationtimestamp| type| source ---|---|--- 2021-10-12 18:25:54+00:00| seen| https://t.me/cibsecurity/30425 2022-02-13 13:50:12+00:00| seen| https://t.me/NeKaspersky/1799 2022-02-14 17:40:00+00:00| seen| https://t.me/truesecator/2627...
CVE-2021-41797
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: non...
CVE-2021-40888
Projectsend version r1295 is affected by Cross Site Scripting XSS due to lack of sanitization when echo output data in returnFilesIds function. A low privilege user can call this function through process.php file and execute scripting code...
CVE-2021-40884
Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id parameter in process.php function, a user with uploader role can download and edit all files of users in application...
CVE-2021-40884
CVE-2021-40884 affects ProjectSend version r1295. The root cause is missing authorization checks for the ids parameter in files-edit.php and the id parameter in process.php, enabling a user with uploader role to download and edit all users’ files. The vulnerability is described across multiple so...
Free BrewDog beer with a side order of shareholder PII?
TL;DR BrewDog exposed the details of over 200,000 ‘Equity for Punks’ shareholders for over 18 months plus many more customers Every mobile app user was given the same hard coded API Bearer Token, rendering request authorisation useless It was therefore trivial for any user to access any other...
A10: Insufficient logging and monitoring ❗️ — Top 10 OWASP 2017
A10: Insufficient logging and monitoring ❗️ — Top 10 OWASP 2017 Introduction Insufficient logging and monitoring is in the Top 10 OWASP for many different reasons. Not only is it hard to detect but it’s also hard to protect from. There are several ways we can protect ourselves from this...
samba: Negative idmap cache entries can cause incorrect group entries in the Samba file server process token
A flaw was found in samba. The Samba smbd file server must map Windows group identities SIDs into unix group ids gids. The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache...
CVE-2021-24465
The Meow Gallery WordPress plugin before 4.1.9 does not sanitise, validate or escape the ids attribute of its gallery shortcode available for users as low as Contributor before using it in an SQL statement, leading to an authenticated SQL Injection issue. The injection also allows the returned...
Booking Core 授权问题漏洞
Booking Core is a software application. A Laravel based booking system designed for travel websites, malls, travel agencies, tour operators, B&Bs, villa rentals, resort rentals, Make Travel websites. An Access Control Error vulnerability exists in Booking Core 2.0, which can be exploited by an...
Improper Access Control in collectiveaccess/pawtucket2
Description An attacker can join any user group in the Pawtucket2 interface as the URLs are not being randomised Proof of Concept Any attacker can join the Administrator group using: http://PAWTUCKETURL/pawtucket/index.php/LoginReg/joinGroup/groupid/2 An attacker can join any group by incrementin...
CVE-2020-18685
Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of unchecked prerequisites related to TCP or UDP ports, or group or table IDs...
Input validation
Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of unchecked prerequisites related to TCP or UDP ports, or group or table IDs...
CVE-2020-18685
Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of unchecked prerequisites related to TCP or UDP ports, or group or table IDs...
CVE-2020-18685
CVE-2020-18685 concerns Floodlight (OpenFlow controller) up to version 1.2. The root cause is poor input validation in the checkFlow method of StaticFlowEntryPusherResource.java, arising from unchecked prerequisites related to TCP/UDP ports and group or table IDs. The vulnerability’s impact per t...
CVE-2021-22948
The CVE-2021-22948 affects revive-adserver, specifically versions prior to 5.3.0. The issue stems from generating session IDs with PHP’s insecure uniqid() function, which under certain conditions could allow an attacker to brute-force session IDs and take over a user account. The Red Hat and NVD ...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-22022. Reason: This candidate is a duplicate of CVE-2020-22022. Notes: All CVE users should reference CVE-2020-22022 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...
About the security content of Safari 15
About the security content of Safari 15 This document describes the security content of Safari 15. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...
About the security content of tvOS 15
About the security content of tvOS 15 This document describes the security content of tvOS 15. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent...
WordPress Catch IDs plugin <= 2.3 - Unauthorized Plugin Setting Change vulnerability
Unauthorized Plugin Setting Change vulnerability discovered by apple502j in WordPress Catch IDs plugin versions = 2.3. Solution Update the WordPress Catch IDs plugin to the latest available version at least 2.4...