17638 matches found
CVE-2022-23711
CVE-2022-23711 describes a sensitive information exposure in Kibana when Elastic Stack monitoring is configured. The vulnerability allows viewing the Monitoring data exposed in the Kibana page source without authentication, affecting users who have set any of the optional monitoring.ui.elasticsea...
CVE-2016-20014
CVE-2016-20014 affects pam_tacplus (pam_tacplus.c) before version 1.4.1, where pam_sm_acct_mgmt does not zero out the arep data structure. Root cause: the arep data structure is not cleared, which is the basis for the vulnerability. The provided connected documents do not specify affected vendor ...
Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2022-1489)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2022-1385
Mattermost 6.4.x and earlier suffer from an improper invalidation of pending email invitations when performed from the system console, allowing accidentally invited users to join a workspace and access information from public channels/teams. This is due to an inadequate invitation invalidation fl...
CVE-2021-39072
CVE-2021-39072 affects IBM Security Guardium 11.1–11.4. The root cause is failure to properly enable HTTP Strict Transport Security, allowing remote attackers to potentially de-obfuscate sensitive data via man-in-the-middle. The IBM Security Guardium bulletin confirms the vulnerability and provid...
CVE-2022-26595
CVE-2022-26595 affects Liferay Portal 7.3.7, 7.4.0, 7.4.1 and Liferay DXP 7.2 FP13, plus 7.3 FP2. The vulnerability arises from inadequate permission checks when accessing a list of sites/groups, allowing remote authenticated users to view sites/groups via the user’s site membership UI. Concrete ...
CISO Forum 2022: the first major Russian security conference in the New Reality
Hello everyone! After a two-year break, I took part in Moscow CISO Forum 2022 with a small talk "Malicious open source: the cost of using someone elses code". Alternative video link for Russia: CISO Forum is the first major Russian conference since the beginning of The New Reality of Information...
Cross site scripting
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository lquixada/cross-fetch prior to 3.1.5...
CVE-2022-23865
creationtimestamp| type| source ---|---|--- 2022-04-15 20:20:14+00:00| seen| https://t.me/cibsecurity/40879...
CVE-2021-44501
CVE-2021-44501 affects FIS GT.M through V7.0-000 (YottaDB code base) where crafted input can make ZRead crash due to a NULL pointer dereference. Documented impact is crash; no explicit exploit details or patch/remediation are provided in the connected sources. Monitor for updates from GT.M/YottaD...
CVE-2021-40402
An out-of-bounds read vulnerability exists in the RS-274X aperture macro multiple outline primitives functionality of Gerbv 2.7.0 and dev commit b5f1eacd, and Gerbv forked 2.7.1 and 2.8.0. A specially-crafted Gerber file can lead to information disclosure. An attacker can provide a malicious file...
CVE-2021-40400
An out-of-bounds read vulnerability exists in the RS-274X aperture macro outline primitive functionality of Gerbv 2.7.0 and dev commit b5f1eacd and the forked version of Gerbv commit d7f42a9a. A specially-crafted Gerber file can lead to information disclosure. An attacker can provide a malicious...
CVE-2020-25162
CVE-2020-25162 is an XPath injection vulnerability affecting B. Braun SpaceCom, Battery Pack SP with Wi‑Fi, and Data module compactplus. Affected software: SpaceCom/L81 (and U61) and Data module compactplus/A10–A11 (non‑US distribution). Root cause per the advisory: improper handling of XPath exp...
CVE-2022-27524
CVE-2022-27524 concerns Autodesk TrueView 2022, where an out-of-bounds read vulnerability occurs while processing a maliciously crafted DWG file. The issue may lead to exposure of sensitive information or a crash, and, in conjunction with other vulnerabilities, could result in code execution in t...
CVE-2022-22541
Technical details beyond the SAP BusinessObjects disclosure description are not provided in the connected documents. No explicit root cause, affected components, or mitigations are listed. Monitor for updates and official advisories.
CVE-2022-27241
Mendix CVE-2022-27241 affects Mendix applications built on versions: 7 (all < 7.23.31), 8 (all < 8.18.18), 9 (all < 9.11), and 9.6 (all
CVE-2022-25650
CVE-2022-25650 affects Mendix-based deployments of Siemens/Mendix: Project versions 7 (before 7.23.27), 8 (before 8.18.14), 9 (before 9.12.0), and 9.6 (before 9.6.3). The issue arises when querying the database and sorting on a protected field, enabling an authenticated attacker to extract inform...
