17606 matches found
CVE-2023-48383
NetVision Information airPASS has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files...
CVE-2023-51804
CVE-2023-51804 affects rymcu forest v0.02. The vulnerability exists in the com.rymcu.forest.web.api.common.UploadController where manipulation of the HTTP body URL enables a remote attacker to obtain sensitive information. Initial metrics indicate CVSSv3.1 base score 7.5 (High) with Attack Vector...
CVE-2023-49261
CVE-2023-49261: Red Hat entries confirm the issue that the tokenKey used in user authorization is visible in the HTML source of the login page. The Red Hat advisories list this description; the connected documents do not provide affected product/version details, exploit information, or remediatio...
CVE-2023-49568 vulnerabilities
Vulnerabilities for packages: gomplate, goreleaser, scorecard, nuclei, pulumi-language-yaml, pulumi-language-java, zot, gitsign, pulumi-kubernetes-operator, src-fingerprint, pulumi-language-dotnet, kots, gitness, kubevela, go-licenses, pulumi, flux-kustomize-controller, apko, bom...
CVE-2024-21613
CVE-2024-21613 affects Juniper Networks Junos OS and Junos OS Evolved. The issue is a Missing Release of Memory after Effective Lifetime in the Routing Protocol Daemon (RPD) that, when traffic engineering is enabled for OSPF or ISIS and a link flap occurs, causes a patroot memory leak leading to ...
CVE-2024-23172
CVE-2024-23172 affects MediaWiki’s CheckUser extension. Affected versions are: MediaWiki before 1.35.14; 1.36.x through 1.39.x before 1.39.6; and 1.40.x before 1.40.2. Root cause is an XSS in message definitions, e.g., in SpecialCheckUserLog . The vulnerability could enable a remote attacker to p...
CVE-2023-51790
CVE-2023-51790 affects piwigo v14.0.0, specifically the Admin Tools plug-in’s lang parameter, which is exposed to enable a cross-site scripting (XSS) vulnerability. The connected sources consistently describe an XSS that could allow a remote attacker to obtain sensitive information. The primary d...
PT-2024-19001 · Unknown · Rubygems.Org
Name of the Vulnerable Software and Affected Versions: Rubygems.org affected versions not specified Description: The issue concerns a workaround on the forgotten password form of Rubygems.org, which allows an attacker to bypass the Multi-Factor Authentication MFA requirement. Normally, users with...
Microsoft SharePoint Exposed Web Services
Due to a misconfiguration in Microsoft SharePoint Server. An attacker with anonymous privileges can access to the SharePoint web services page. No source data...
CVE-2023-42828
This CVE (CVE-2023-42828) is tied to macOS crontabs and a lack of access control that may allow a local attacker to gain root privileges. PT-2023-8342 describes the root cause in crontabs, noting macOS Ventura 13.5 fixes this by removing the vulnerable code. Affected product/version: macOS Ventur...
CVE-2022-32931
CVE-2022-32931 affects macOS Ventura 13; the issue allowed an app with root privileges to access private information. Apple patched this by addressing data protection shortcomings in Ventura 13. Remediation: update to macOS Ventura 13 (or later) where the fix is implemented. All other details in ...
CVE-2023-47171
CVE-2023-47171 affects WWBN AVideo 11.6 and the dev master (commit 15fed957fb). TALOS documents an information disclosure via the aVideoEncoder.json.php chunkFile path functionality, allowing an attacker to read arbitrary files by supplying a crafted chunkFile parameter in an HTTP request. The ad...
Design/Logic Flaw
Totolink N200REV5 V9.3.5u.6255B20211224 is vulnerable to Incorrect Access Control. The device allows remote attackers to obtain Wi-Fi system information, such as Wi-Fi SSID and Wi-Fi password, without logging into the management page...
CVE-2020-26627
CVE-2020-26627 : Concrete details show a Time-Based SQL Injection in Hospital Management System V4.0 and earlier, exploitable via the adminremark field under “Contact Us Queries -> Unread Query.” The root cause is lack of input validation for externally entered SQL statements, enabling an atta...
CVE-2024-20657
creationtimestamp| type| source ---|---|--- 2024-01-09 19:26:40+00:00| seen| https://t.me/ctinow/165262 2024-01-09 19:47:25+00:00| seen| https://t.me/ctinow/165289...
deaf-server.adw.uni-heidelberg.de Cross Site Scripting vulnerability OBB-3830291
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2024-22125
Under certain conditions the Microsoft Edge browser extension SAP GUI connector for Microsoft Edge - version 1.0, allows an attacker to access highly sensitive information which would otherwise be restricted causing high impact on confidentiality...
CVE-2024-22124
CVE-2024-22124 affects SAP NetWeaver Internet Communication Manager and SAP Web Dispatcher—specifically listed kernel and related components (KERNEL 7.22/7.53/7.54; KRNL64UC 7.22/7.53; KRNL64NUC 7.22/7.22_EXT; WEBDISP 7.22_EXT/7.53/7.54). The vulnerability enables an attacker to access informatio...
CVE-2023-49235
The CVE-2023-49235 entry affects TRENDnet TV-IP1314PI devices (firmware 5.5.3 200714) via libremote_dbg.so. The root cause is mishandled filtering of debug information during use of popen, which can allow an attacker to bypass validation and execute a shell command. Red Hat/NVD entries corroborat...