1681 matches found
secureCodingDemo
secureCodingDemo fall2022 secure coding CVE-2019-13272 : Linux Kernel Improper Privilege Management Vulnerability Georgette Kendall CSEC 302 Monday, November 14, 2022 Links included in the .txt file...
CVE-2026-83885: Inadequate Encryption Strength
Inadequate encryption strength in Windows Virtualization-Based Security VBS Enclave allows an authorized attacker to perform spoofing locally...
DevTools Suite DoS
The vulnerability in Google Chrome and Microsoft Edge’s DevTools web development tools is related to improper thread management. Exploiting this vulnerability allows a remote attacker to cause a denial of service by sending a specially crafted HTML page...
PT-2026-112648
Name of the Vulnerable Software and Affected Versions Windows Virtualization-Based Security VBS Enclave affected versions not specified Description Inadequate encryption strength in the Virtualization-Based Security VBS Enclave allows an authorized attacker to perform local spoofing. VBS Enclave ...
EUVD-2026-96303
ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through reflection and retrieve relevant information...
Rocky Linux 9 [CIQ] Security Update: libdnf-plugin-subscription-manager / etc (crlsa-2023_4708)
The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20234708 advisory. subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus interface allows local users to modify configuration CVE-2023-3899 Tenable has extracted th...
Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in PySpark (CVE-2025-55039)
Summary A deserialization vulnerability in the PySpark component CVE-2025-55039 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 3.5.8. Vulnerability Details CVEID:CVE-2025-55039 DESCRIPTION: This issue affects Apache Spark versions before 3.4.4...
EUVD-2026-82782
HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulting in unauthorized system access...
CVE-2026-86824: Inadequate Encryption Strength
The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session toke...
CVE-2026-77405: Inadequate Encryption Strength
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when...
CVE-2026-12258 Inadequate access control in the Hiperdino REST API
Inadequate access control in Hiperdino’s REST v1.0 API. The public endpoint ‘customer/check’ could allow an authenticated attacker to enter a telephone number or an email address. When the value entered belongs to a registered customer, the service returns the associated information email address...
PT-2026-89020
Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded ...
EUVD-2026-72013
SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization...
EUVD-2026-71855
The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the authoritative payment was actually made for, checking only that the amount paid is at least the referenced product's price, allowing...
CVE-2026-81196 MasterStudy LMS < 3.7.46 - Instructor+ Quiz Answer Disclosure via IDOR
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations...
PT-2026-84897
Name of the Vulnerable Software and Affected Versions Webform Submissions Delete versions 0.0.0 through 1.2.0 Description Insufficient access restrictions on the delete form allow forceful browsing, which occurs when a user accesses a page or resource without proper authorization. This issue allo...
CVE-2026-17520: Inadequate Encryption Strength
The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails,...
Chromium: CVE-2026-79084 Inadequate encryption strength in Notifications
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
CVE-2026-64896 T2000 open debug port
Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects T2000: before 31.6...
CVE-2026-64896
Johnson Controls T2000 (before 31.6 ) is affected by a Debug and Test Interface with Improper Access Control vulnerability, described as an open debug port that allows an attacker to access functionality not properly constrained by ACLs. The CNA-assigned CVSS 4.0 score is 5.2 (MEDIUM) with a phys...