1153 matches found
Directory Traversal
xmpphttpupload is vulnerable to directory traversal. The vulnerability exists through the unsafe implementation of sanitizedjoin, where the .. input can be used to bypass the application root directory...
EulerOS 2.0 SP3 : sqlite (EulerOS-SA-2020-2059)
According to the versions of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a...
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the join command when using the -i switch which triggers a stack-based buffer overflow in the alloca function.
...
New Relic: removed user can still join the organization
hi, i would like to report an issue i have found that allow attacker to join organization even if the attacker is removed. i found out that when adding new user, if you add a new user without verifying the email address, you change the email of the user, the email address you initially send the...
CVE-2020-3542
A vulnerability in Cisco Webex Training could allow an authenticated, remote attacker to join a password-protected meeting without providing the meeting password. The vulnerability is due to improper validation of input to API requests that are a part of meeting join flow. An attacker could explo...
CVE-2020-3542 Cisco Webex Training Unauthorized Meeting Join Vulnerability
A vulnerability in Cisco Webex Training could allow an authenticated, remote attacker to join a password-protected meeting without providing the meeting password. The vulnerability is due to improper validation of input to API requests that are a part of meeting join flow. An attacker could explo...
CVE-2020-3542 Cisco Webex Training Unauthorized Meeting Join Vulnerability
A vulnerability in Cisco Webex Training could allow an authenticated, remote attacker to join a password-protected meeting without providing the meeting password. The vulnerability is due to improper validation of input to API requests that are a part of meeting join flow. An attacker could explo...
cloudcmd (>=5.0.5 <=9.3.2), console-io (>=2.5.2 <=5.0.0) +22 more potentially affected by unknown CVE via ponse (>=1.0.1 <=1.6.1)
ponse NPM version =1.0.1, =5.0.5, =2.5.2, =0.0.0, =0.1.0, =2.7.4, =0.3.0, =1.0.0, =1.0.0, =0.0.1, =0.2.0, =1.0.0, =1.0.0, =1.0.9, =1.0.0, =1.0.0, =1.3.6 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WFHX-6PCM-7M55...
Cisco Webex Training Unauthorized Meeting Join Vulnerability
A vulnerability in Cisco Webex Training could allow an authenticated, remote attacker to join a password-protected meeting without providing the meeting password. The vulnerability is due to improper validation of input to API requests that are a part of meeting join flow. An attacker could explo...
GHSA-67J9-C52G-W2Q9 Authorization Bypass in I hate money
Impact An authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's private code. With the default...
OpenJDK: Incorrect handling of access control context in ForkJoinPool (Libraries, 8237117)
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...
OpenJDK: Incorrect handling of access control context in ForkJoinPool (Libraries, 8237117)
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...
CVE-2020-15779
A Path Traversal issue was discovered in the socket.io-file package through 2.0.31 for Node.js. The socket.io-file::createFile message uses path.join with ../ in the name option, and the uploadDir and rename options determine the path...
CVE-2019-20893
An issue was discovered in Activision Infinity Ward Call of Duty Modern Warfare 2 through 2019-12-11. PartyHostHandleJoinPartyRequest has a buffer overflow vulnerability and can be exploited by using a crafted joinParty packet. This can be utilized to conduct arbitrary code execution on a victim'...
Unspecified Vulnerability in Mattermost Server (CNVD-2020-41174)
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 4.8.1, 4.7.4 and 4.6.3. An attacker can use this vulnerability to obtain the inviteid of a team and then repeatedly ask...
Unspecified Vulnerability in Mattermost Server (CNVD-2020-41490)
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 5.8.0 that stems from the program not following domain name requirements when processing join requests for public teams. An...
CVE-2019-20882
An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement when processing a join request for an open team...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement when processing a join request for an open team...
CVE-2019-20882
Mattermost Server before 5.8.0 does not honor the domain requirement when processing a join request for an open/public team. Root cause: domain validation in the join flow is insufficient, enabling potential unauthorized joining of public teams (exploit described in CNVD/DOCs). Affected version r...