175 matches found
CVE-2020-10130
CVE-2020-10130 - SearchBlox Product before V-9.1 is vulnerable to Business logic bypass Product Description: SearchBlox simplifies enterprise search for complex organizations. SearchBlox intuitive and intelligent tools offer out-of-the-box setup, secure encryption, and low total cost of ownership...
CVE-2024-53677
POC from https://y4tacker.github.io/2024/12/16/year/2024/12/Apache-Struts2-%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E9%80%BB%E8%BE%91%E7%BB%95%E8%BF%87-CVE-2024-53677-S2-067/ RCE Conditions No restriction on dangerous file extensions File name obtained from upload parameters when uploading files...
CVE-2020-37289
Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals, to be stored in uint256 variables without bounds checking. Malicious contracts can return values greater than 255 to manipulate or bypass contract logic that relies on these values...
CVE-2020-37289
Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals, to be stored in uint256 variables without bounds checking. Malicious contracts can return values greater than 255 to manipulate or bypass contract logic that relies on these values...
EUVD-2020-31285
Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals, to be stored in uint256 variables without bounds checking. Malicious contracts can return values greater than 255 to manipulate or bypass contract logic that relies on these values...
PT-2026-120158
Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals, to be stored in uint256 variables without bounds checking. Malicious contracts can return values greater than 255 to manipulate or bypass contract logic that relies on these values...
CVE-2026-56596
HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended application behavior...
EUVD-2026-93373
HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended application behavior...
CVE-2026-56596
The HCL BigFix Service Management software is affected by an Improper Input Validation vulnerability (CWE-20). This flaw could allow an attacker to provide malformed or unexpected data, potentially leading to processing errors , business logic bypasses , and unintended application behavior . The ...
CVE-2026-56596 HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended application behavior...
CVE-2026-56596 HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended application behavior...
PT-2026-106713
HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended application behavior...
CVE-2026-56596: Improper Input Validation
HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended application behavior...
CVE-2026-82982
The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and...
CVE-2026-86753
snipe-it (asset management application by grokability) versions before 8.7.0 contain a business logic bypass in the POST /account/request/asset_model/{modelId} endpoint. The root cause is a failure to validate the requestable flag for asset models, allowing authenticated users to bypass administr...
CVE-2026-86753 snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint
snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/assetmodel/modelId endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly ...
CVE-2026-86753 snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint
snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/assetmodel/modelId endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly ...
CVE-2026-86753 snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint
snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/assetmodel/modelId endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly ...
EUVD-2026-58189
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...
PT-2026-71723
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...