27766 matches found
Design/Logic Flaw
Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier is vulnerable to Execution with Unnecessary Privileges...
Data Leakage Protection (DLP) System Logic Flaw Vulnerability at Beijing Yisetong Technology Development Co.
Data Leakage Protection DLP system is aimed at serving enterprises and institutions for data asset grooming and data security protection. The Data Leakage Protection DLP system of Beijing Yisetong Technology Development Co., Ltd. has a logic flaw vulnerability, which can be exploited by attackers...
The vulnerability of the microprogrammed software of the MELSEC WS0-GETH00200 programmable logic controllers, related to bypassing the authentication process, allows a intruder to circumvent the authentication mechanism.
The vulnerability of the microprogrammed software of the MELSEC WS0-GETH00200 programmable logic controllers is related to the bypassing of the authentication process. Exploiting this vulnerability allows an attacker to bypass the authentication process remotely...
Design/Logic Flaw
The WP Club Manager – WordPress Sports Club Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settingssave function in all versions up to, and including, 2.2.10. This makes it possible for unauthenticated attackers to update th...
Design/Logic Flaw
The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveview' function in all versions up to, and including, 3.2.2. This makes it possible for authenticated...
Design/Logic Flaw
The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system. While there are no known exploits, this is an example of “CWE-732: Incorrect Permission Assignment for Critical...
Design/Logic Flaw
A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data...
Design/Logic Flaw
Sulu is a highly extensible open-source PHP content management system based on the Symfony framework. There is an issue when inputting HTML into the Tag name. The HTML is executed when the tag name is listed in the auto complete form. Only admin users can create tags so they are the only ones...
Design/Logic Flaw
phpMyFAQ is an Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The 'sharing FAQ' functionality allows any unauthenticated actor to misuse the phpMyFAQ application to send arbitrary emails to a large range of targets. The phpMyFAQ application has a...
Design/Logic Flaw
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. phpMyFAQ's user removal page allows an attacker to spoof another user's detail, and in turn make a compelling phishing case for removing another user's account. The front-end of this page doesn'...
Design/Logic Flaw
media-server v1.0.0 was discovered to contain a Use-After-Free UAF vulnerability via the sipsubscriberemove function at /uac/sip-uac-subscribe.c...
Design/Logic Flaw
python-multipart is a streaming multipart parser for Python. When using form data, python-multipart uses a Regular Expression to parse the HTTP Content-Type header, including options. An attacker could send a custom-made Content-Type option that is very difficult for the RegEx to process, consumi...
Design/Logic Flaw
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status OCSP stapling test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check...
Design/Logic Flaw
HCL DevOps Deploy / HCL Launch UCD could disclose sensitive user information when installing the Windows agent...
Design/Logic Flaw
Ylianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm...
Design/Logic Flaw
Graphviz 2.36 before 10.0.0 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root...
Design/Logic Flaw
IBM PowerSC 1.3, 2.0, and 2.1 uses insecure HTTP methods which could allow a remote attacker to perform unauthorized file request modification. IBM X-Force ID: 275109...
Design/Logic Flaw
In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product responds back with an error message containing sensitive data if it receives a specific malformed request...