CVE-2022-20618: Missing Authorization

A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins...

Missing permission checks in ssh-agent allow enumerating credentials IDs

ssh-agent 1.23 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability. An...

PT-2022-28349

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.15 through v5.15.12 Description The issue is related to a memory leak in the dbgfs target ids write function. This leak occurs with the struct pid and has been identified in the Linux Kernel. The actual impact and...

Information Disclosure

github.com/binance-chain/tss-lib is vulnerable to information disclosure. The library does not properly validate the maliciously chosen IDs when creation of Parties IDs, allowing an attacker to reveal the users secrets during the secret-sharing procedure and leads to system crash...

Incorrect validation of parties IDs leaks secret keys in Secret-sharing scheme

Summary In the threshold signature scheme, participants start by dividing secrets into shares using a secret sharing scheme. The Verifiable Secret Sharing scheme generates shares from the user’s IDs but does not properly validate them. Using a malicious ID will make other users reveal their secre...

Non unique token ID might lead to collusion when merging

Handle kenzo Vulnerability details Token IDs are defined as concatenation of points, total supply + 1. The total supply can decrease when merging. This means that the contract might try to mint a token with an ID which already exists. Impact Under specific circumstances, users won't be able to lo...

PT-2021-8071

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the DAMON debugfs interface in the Linux kernel, which increases the reference counts of struct pids for targets from the 'target ids' file write callback dbgfs...

Amios Emuse-eServices/eNvoice has an unspecified vulnerability

Amios Emuse-eServices/eNvoice is an electronic invoicing service from the Israeli company Amios. It is a digital interface that simplifies the collection process and automatically sends invoices to customers via email. Amios Emuse-eServices/eNvoice suffers from a security vulnerability that stems...

CVE-2021-36723

Emuse - eServices / eNvoice Exposure Of Private Personal Information due to lack of identification mechanisms and predictable IDs an attacker can scrape all the files on the service...

Code injection

Emuse - eServices / eNvoice Exposure Of Private Personal Information due to lack of identification mechanisms and predictable IDs an attacker can scrape all the files on the service...

CVE-2021-36723 Emuse - eServices / eNvoice Exposure Of Private Personal Information

Emuse - eServices / eNvoice Exposure Of Private Personal Information due to lack of identification mechanisms and predictable IDs an attacker can scrape all the files on the service...

Amios Emuse – eServices/eNvoice information leakage vulnerability

Amios Emuse-eServices/eNvoice is an electronic invoicing service from the Israeli company Amios. It is a digital interface that simplifies the collection process and automatically sends invoices to customers via email. Amios Emuse-eServices/eNvoice suffers from a security vulnerability that stems...

CVE-2021-36723: Exposure of Private Personal Information to an Unauthorized Actor

Emuse - eServices / eNvoice Exposure Of Private Personal Information due to lack of identification mechanisms and predictable IDs an attacker can scrape all the files on the service...

CVE-2021-36723

Emuse - eServices / eNvoice Exposure Of Private Personal Information due to lack of identification mechanisms and predictable IDs an attacker can scrape all the files on the service...

PT-2021-24250 · Netbsd · Netbsd

Name of the Vulnerable Software and Affected Versions: NetBSD versions prior to 9.3 Description: The issue concerns a weak cryptographic PRNG used in the IPv6 fragment ID generation algorithm. Recommendations: For NetBSD versions prior to 9.3, update to version 9.3 or later to resolve the issue...

OPENSUSE-SU-2021:1602-1 Security update for nextcloud

This update for nextcloud fixes the following issues: Update to 20.0.14 Security issues fixed: CVE-2021-41179: Fix boo1192028 - CWE-304: Two-Factor Authentication not enforced for pages marked as public CVE-2021-41178: Fix boo1192030 - CWE-434: File Traversal affecting SVG files on Nextcloud Serv...

CVE-2021-39315

The Magic Post Voice WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the ids parameter found in the /inc/admin/main.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2...

CVE-2021-39315

The Magic Post Voice WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the ids parameter found in the /inc/admin/main.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2...

CVE-2021-39315 Magic Post Voice <= 1.2 Reflected Cross-Site Scripting

The Magic Post Voice WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the ids parameter found in the /inc/admin/main.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2...

PT-2021-22524

Name of the Vulnerable Software and Affected Versions: The Magic Post Voice WordPress plugin versions up to and including 1.2 Description: The issue allows attackers to inject arbitrary web scripts via the ids parameter found in the /inc/admin/main.php file, enabling Reflected Cross-Site Scriptin...