2622 matches found
CVE-2023-3747 Insufficient Validation on Override Codes for Always-Enabled WARP Mode
Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created by the Administrators to allow a device to temporarily be disconnected from WARP, however, due to lack of server side validation, an attacker with local access...
CVE-2023-3747 Insufficient Validation on Override Codes for Always-Enabled WARP Mode
Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created by the Administrators to allow a device to temporarily be disconnected from WARP, however, due to lack of server side validation, an attacker with local access...
PT-2023-36421 · Undefined · Undefined
Уязвимость метода CreateAttachmentFromUri почтового сервера Microsoft Exchange Server связана с недостаточной проверкой поступающих запросов. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, раскрыть защищаемую информацию...
The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow lies in the insufficient checking of incoming requests. This allows attackers to disclose sensitive information or cause service failures.
The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow is related to insufficient validation of incoming requests. Exploiting this vulnerability can allow a malicious actor to expose sensitive information or cause service failures by...
The vulnerability of the Request package on the Node.js software platform allows a attacker to perform an SSRF attack.
The vulnerability of the Request package in the Node.js software platform is related to insufficient validation of incoming requests. Exploiting this vulnerability allows a remote attacker to execute an SSRF attack...
Relative path traversal
Description The endpoint /system/data-exports/:filename is intended to export AnythingLLM data zip file for download based on a specified filename parameter. However, a critical security vulnerability arises due to insufficient validation and sanitization of the request.params.filename parameter...
PT-2023-5907
Name of the Vulnerable Software and Affected Versions Gevent versions prior to 23.9.1 Gevent version 23.9.0 Description The issue in Gevent is related to insufficient validation of executed requests in the WSGIServer component, allowing a remote attacker to escalate privileges via a crafted scrip...
Debian dla-3545 : python3-flask-security - security update
The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3545 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3545-1 [email protected] https://www.debian.org/lts/security/...
Sql injection
Online Shopping Portal Project 3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in the username field, enabling...
Stored XSS
Description Due to insufficient validation of uploaded files - bad actors can upload malicious SVG file with XSS payload. That leads to Stored XSS. Because accessToken cookie has valid HttpOnly flag, can not take victims cookie there in this way, but please keep in mind that XSS in general is abo...
RubyGems 输入验证错误漏洞
RubyGems is a Ruby package manager from the RubyGems organization. The product is primarily used to distribute and manage Ruby packages. RubyGems suffers from an input validation error vulnerability that stems from insufficient input validation and allows malicious actors to replace files...
Cross site scripting
A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager EPNM could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface on an affected device. The...
The vulnerability of the modVulnerabilityProtect widget in the monitoring and security management panel of Trend Micro Apex Central allows a attacker to perform an SSRF attack.
The vulnerability of the modVulnerabilityProtect widget in the monitoring and security management panel of Trend Micro Apex Central is related to insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack remotely...
CVE-2023-20564
Insufficient validation in the IOCTL Input Output Control input buffer in AMD Ryzen™ Master may permit a privileged attacker to perform memory reads/writes potentially leading to a loss of confidentiality or arbitrary kernel execution...
CVE-2023-20560
Insufficient validation of the IOCTL Input Output Control input buffer in AMD Ryzen™ Master may allow a privileged attacker to provide a null value potentially resulting in a Windows crash leading to denial of service...
CVE-2023-20560
The CVE-2023-20560 issue is an Intel IOCTL input buffer validation vulnerability in AMD Ryzen™ Master. The root cause is insufficient validation of the IOCTL input buffer in Ryzen Master, which could allow a privileged attacker to supply a null value, potentially causing a Windows crash and resul...
CVE-2023-20560
Insufficient validation of the IOCTL Input Output Control input buffer in AMD Ryzen™ Master may allow a privileged attacker to provide a null value potentially resulting in a Windows crash leading to denial of service...
CVE-2023-20560
Insufficient validation of the IOCTL Input Output Control input buffer in AMD Ryzen™ Master may allow a privileged attacker to provide a null value potentially resulting in a Windows crash leading to denial of service...
CVE-2023-20564
Insufficient validation in the IOCTL Input Output Control input buffer in AMD Ryzen™ Master may permit a privileged attacker to perform memory reads/writes potentially leading to a loss of confidentiality or arbitrary kernel execution...
CVE-2023-20564
Insufficient validation in the IOCTL Input Output Control input buffer in AMD Ryzen™ Master may permit a privileged attacker to perform memory reads/writes potentially leading to a loss of confidentiality or arbitrary kernel execution...