17635 matches found
CVE-2022-3225
CVE-2022-3225 affects budibase/budibase prior to 1.3.20, described as Improper Control of Dynamically-Managed Code Resources with an associated access-control weakness. The public documents also annotate this as an Improper Access Control vulnerability (GHSA and related advisories). Root cause ci...
centre-de-sante-richerand.fr Cross Site Scripting vulnerability OBB-2925513
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Security Bulletin: Information regarding security vulnerability in IBM SDK for Java that is shipped with IBM WebSphere Application Server and addressed by Oracle CPU October 2013
Summary Multiple security vulnerabilities exist in the IBM SDK for Java that is shipped with IBM WebSphere Application Server and included in the products that are listed in this document. Vulnerability Details The products that are listed in the Affected product section are shipped with a versio...
SharpImpersonation - A User Impersonation Tool - Via Token Or Shellcode Injection
This was a learning by doing project from my side. Well known techniques are used to built just another impersonation tool with some improvements in comparison to other public tools. The code base was taken from: https://github.com/0xbadjuju/Tokenvator A blog post for the intruduction can be foun...
CVE-2022-40737
Bento4
CVE-2022-1972
CVE-2022-1972 is rejected/not used and does not represent an active vulnerability entry.
CVE-2022-35946
GLPI vulnerability CVE-2022-35946 is a misvalidation in the plugin controller that can expose the low-level Plugin class API. An attacker with General setup rights can alter database data via this input handling flaw. The recommended fix is upgrading GLPI to version 10.0.3; as a workaround, remov...
CVE-2022-31143 Leak of sensitive information through login page error in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. It was found that in affected versions there is an exposure of private information defined in setup of...
Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Digital Business Automation Workflow family products (Java CPU April 2019)
Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow, IBM Business Process Manager, WebSphere Enterprise Service Bus, and WebSphere Lombardi Edition. WebSphere Application Server Liberty is shipped as a component of the optional BPM component Process...
CVE-2022-22330
CVE-2022-22330 affects IBM Control Desk 7.6.x (notably 7.6.1) and is caused by the HTTPOnly flag not being set on a cookie (BAYEUX_BROWSER). A remote attacker could access cookie data due to this missing flag. IBM’s security bulletin confirms the vulnerability and provides a remediation path: upg...
EUVD-2022-38711
HTTP V3 Denial of Service Vulnerability...
CVE-2022-3027
CVE-2022-3027 affects Contec Health CMS8000 CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor. The issue is an improper control/sanitization of the SSID name for a new Wi‑Fi access point, allowing an attacker to craft an SSID with malicious/non‑standard characters. When the device attempts to co...
CVE-2022-2989
CVE-2022-2989 affects Podman and is caused by incorrect handling of supplementary groups inside a container, enabling potential information disclosure or data modification when an attacker has direct container access and can execute code. Connected documents confirm affected Podman versions older...
How GRC protects the value of organizations — A simple guide to data quality and integrity
Contemporary organizations understand the importance of data and its impact on improving interactions with customers, offering quality products or services, and building loyalty. Data is fundamental to business success. It allows companies to make the right decisions at the right time and deliver...
CVE-2022-39154
Summary (CVE-2022-39154) : Siemens Parasolid and Simcenter Femap are affected by an out-of-bounds write past the end of an allocated buffer when parsing specially crafted X_T files, enabling potential code execution in the current process. Affected products/versions include Parasolid V33.1 (prior...
Expedia Group Bug Bounty: Cache Deception Allows Account Takeover
A vulnerability allowed an attacker to extract a user's session token from a cacheable page, leading to account takeover. The session token was reflected in the response of a cacheable URL, and the server responded with a 200 OK. The caching server saw the response as cacheable due to the file...
The North Face hit by credential stuffing attack
The North Face clothing brand, which specialises in outdoor and heavy weather outerwear, has experienced a "large-scale" credential stuffing attack. This has resulted in no fewer than 194,905 accounts being compromised. What is credential stuffing, and how did it affect The North Face customers?...
Function getRedeemAmountOut can't deliver was it should be
Lines of code Vulnerability details Proof of Concept The fn of getRedeemAmountOut can't be deliver the same as it should be eversince it has @params uint256 amountIn and return amountIn which clearly should be amountFeiIn. So the calculate would be deliver wrong value. Tools Used Manual Review...
Weak Password Vulnerability in Netnifty Firewall System
Beijing NetGuard Nebula Information Technology Company is a leading enterprise in the domestic information security industry, specializing in the research and development, production and sales of information security products. A weak password vulnerability exists in the Netnifty Firewall system,...