17614 matches found
CVE-2023-2444
CVE-2023-2444 is a CSRF vulnerability in Rockwell Automation FactoryTalk Vantagepoint. Affected product: FactoryTalk Vantagepoint (all versions prior to 8.40). Root cause: insufficient verification of data authenticity enabling CSRF attacks that could impersonate a legitimate user and send reques...
CVE-2022-42878
CVE-2022-42878 affects Intel® Trace Analyzer and Collector software prior to 2021.8.0 (and related Intel HPC Toolkit components). Root cause is a null pointer dereference that could allow an authenticated local user to disclose information. Exploitation details are not provided in the supplied do...
CVE-2023-32113
SAP GUI for Windows - version 7.70, 8.0, allows an unauthorized attacker to gain NTLM authentication information of a victim by tricking it into clicking a prepared shortcut file. Depending on the authorizations of the victim, the attacker can read and modify potentially sensitive information aft...
CVE-2022-48379
CVE-2022-48379 concerns UNISOC chipsets where the dialer service lacks a permission check, enabling local denial of service without elevated execution privileges. The common details across sources indicate the root cause is insufficient permission validation in the dialer component, with an impac...
CVE-2022-48370
CVE-2022-48370 describes a local information disclosure in the Unisoc dialer service due to a missing permission check. The vulnerability affects Unisoc chipsets’ dialer component and could allow access to sensitive data without extra execution privileges. No explicit affected version ranges or p...
CVE-2022-47487
CVE-2022-47487 affects UNISOC chipsets (thermal service). Root cause: missing bounds check leading to an out-of-bounds write. Impact: local denial of service with no additional execution privileges. Exploitation status and patch details are not provided in the supplied documents. No explicit reme...
CVE-2023-28764
CVE-2023-28764 affects SAP BusinessObjects Platform versions 420 and 430, specifically the Information design tool. The vulnerability stems from transmitting sensitive information in cleartext over the network within the Information design tool binaries, enabling an unauthenticated attacker with ...
CVE-2023-27954
The issue was addressed by removing origin information. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, tvOS 16.4, watchOS 9.4. A website may be able to track sensitive user information...
andrewzolli.com Cross Site Scripting vulnerability OBB-3303202
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
autodiscover.certificados.fae.ufmg.br Cross Site Scripting vulnerability OBB-3300100
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
File Thingie 2.5.7 - Remote Code Execution (RCE)
!/usr/bin/python Exploit Title: File Thingie 2.5.7 - Arbitary File Upload to RCE Google Dork: N/A Date: 27th of April, 2023 Exploit Author: Maurice Fielenbach grimlockx - Hexastrike Cybersecurity UG haftungsbeschränkt Software Link: https://github.com/leefish/filethingie Version: 2.5.7 Tested on:...
CVE-2023-25289
CVE-2023-25289 affects virtualreception Digital Receptie running on Windows (win7sp1_rtm.101119-1850, 6.1.7601.1.0.65792) where the embedded web server is vulnerable to a Directory Traversal via crafted GET requests, allowing an attacker to obtain sensitive information. Affected component: embedd...
CVE-2023-21497
CVE-2023-21497 affects the mPOS TUI trustlet (Samsung devices) prior to SMR May-2023 Release 1. It arises from an externally-controlled format string vulnerability that could allow a local attacker to access memory addresses. Affected component: mPOS TUI trustlet; root cause: format string handli...
Exploit for Code Injection in Vmware Spring_Cloud_Function
CVE-2022-22963 Remote Code Execution exploiting CVE-2022-2296...
projectSend r1605 Private File Download
Exploit Title: projectSend r1605 - Private file download Application: projectSend Version: r1605 Bugs: IDOR Technology: PHP Vendor URL: https://www.projectsend.org/ Software Link: https://www.projectsend.org/ Date of found: 24-01-2023 Author: Mirabbas Ağalarov Tested on: Linux Technical Details &...
CVE-2023-1265
CVE-2023-1265 affects GitLab installations with the following vulnerable ranges: 11.9–15.9.6, 15.10–15.10.5, and 15.11–15.11.1. The issue enables a privileged attacker, under certain conditions, to obtain session tokens for all users on a GitLab instance. The provided documents do not specify the...
CVE-2023-2069
GitLab CVE-2023-2069 affects multiple release tracks: 10.0–12.9.7, 12.10–12.10.6, and 13.0–13.0.0. The vulnerability allows a user with the Developer role to leak CI/CD variables via the Import Project feature. The issue’s root cause is tied to that feature’s handling of project import, enabling ...
NIST Draft Document on Post-Quantum Cryptography Guidance
NIST has released a draft of Special Publication1800-38A: "Migration to Post-Quantum Cryptography: Preparation for Considering the Implementation and Adoption of Quantum Safe Cryptography." Its only four pages long, and it doesnt have a lot of detail--more "volumes" are coming, with more...