Cross-Site Scripting (XSS)

gitlab is vulnerable to Cross-Site Scripting XSS attacks. An attacker could gain access to an integration's access token, which could then be used to impersonate the integration and perform unauthorized actions...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability allows a project maintainer to access the DataDog integration API key from webhook logs resulting in disclosure of sensitive information...

CVE-2023-39143

PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled a very common configuration...

CVE-2023-39143

PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled a very common configuration...

Balancer swap fee is not set and quote properly when Rebalancing

Lines of code Vulnerability details Impact Rebalance may revert Proof of Concept The rebalance functon tightly integrate with stargate and layezero however, the swap fee is not quoted and calculated the swap erc20.approveaddressrouter, amount; router.swap dstChainId, srcPoolId, dstPoolId, oft,...

CVE-2023-39143

PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled a very common configuration...

CVE-2023-21408

Due to insufficient file permissions, unprivileged users could gain access to unencrypted user credentials that are used in the integration interface towards 3rd party systems...

CVE-2023-21408

Due to insufficient file permissions, unprivileged users could gain access to unencrypted user credentials that are used in the integration interface towards 3rd party systems...

Authorization

Due to insufficient file permissions, unprivileged users could gain access to unencrypted user credentials that are used in the integration interface towards 3rd party systems...

CVE-2023-21408 Insufficient file permissions leak user credentials of 3rd party integration interfaces in AXIS License Verifier ACAP

Due to insufficient file permissions, unprivileged users could gain access to unencrypted user credentials that are used in the integration interface towards 3rd party systems...

CVE-2023-21408 Insufficient file permissions leak user credentials of 3rd party integration interfaces in AXIS License Verifier ACAP

Due to insufficient file permissions, unprivileged users could gain access to unencrypted user credentials that are used in the integration interface towards 3rd party systems...

CVE-2023-21408

CVE-2023-21408: The description indicates an issue of insufficient file permissions that could let unprivileged users access unencrypted credentials used by the integration interface to third-party systems. The provided metrics show a high to critical impact (confidentiality, integrity, availabil...

Cloudflare Public Bug Bounty: Yet Another CASB Integration Takeover of Active Integrations

A vulnerability was found in a cloud access security broker's Microsoft integration where an attacker could bypass confused deputy protections. By manipulating the casing of a tenant UUID, a new integration could be created that surfaced sensitive customer information. This issue was addressed by...

The vulnerability of the The Message Display Tool (MDT) software component, used for integrating corporate applications in SAP NetWeaver Process Integration, allows a perpetrator to disclose protected information.

The vulnerability of the The Message Display Tool MDT software component, used for integrating corporate applications in SAP NetWeaver Process Integration, is related to the lack of protection for operational data. Exploiting this vulnerability could allow a malicious actor to disclose sensitive...

CVE-2023-24971

IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterprise Integration Gateway 1.0.0.1 could allow a user to cause a denial of service due to the deserializing of untrusted serialized Java objects. IBM X-Force ID: 246976...

Cross site scripting

IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterprise Integration Gateway 1.0.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...

CVE-2023-24971

The CVE-2023-24971 issue affects IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterprise Integration Gateway 1.0.0.1, caused by deserializing untrusted Java objects, leading to denial of service. Affected components are the Java deserialization path; impact is availability (DENIAL OF SER...

CVE-2023-24971 IBM B2B Advanced Communication denial of service

IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterprise Integration Gateway 1.0.0.1 could allow a user to cause a denial of service due to the deserializing of untrusted serialized Java objects. IBM X-Force ID: 246976...

CVE-2023-22595

CVE-2023-22595 affects IBM B2B Advanced Communications (1.0.0.x) and IBM Multi-Enterprise Integration Gateway (1.0.0.1). A cross-site scripting flaw allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure in a trusted session. Remediation: apply fix pack...

Apache InLong Deserialization Vulnerability (CNVD-2023-70280)

Apache InLong is the U.S. Apache Apache Foundation's one-stop massive data integration framework. Provides automated, secure and reliable data transfer capabilities. A deserialization vulnerability exists in Apache InLong versions 1.4.0 to 1.7.0. The vulnerability stems from insecure...