U.S. Dept Of Defense: Adobe ColdFusion Access Control Bypass - CVE-2023-38205

A vulnerability in Adobe ColdFusion was discovered that allowed bypassing access controls by using malicious path traversal in URLs targeting the /CFIDE/wizards/common/utils.cfc endpoint. This enabled attackers to reach endpoints that should have been restricted. The issue affected Adobe ColdFusi...

SUSE CVE-2021-45116

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a...

GSD-2023-1001569 ACPICA: Fix error code path in acpi_ds_call_control_method()

ACPICA: Fix error code path in acpidscallcontrolmethod This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.337 by commit...

CVE-2022-33701

Improper access control vulnerability in KnoxCustomManagerService prior to SMR Jul-2022 Release 1 allows attacker to call PowerManaer.goToSleep method which is protected by system permission by sending braodcast intent...

ruby: Code injection via command argument of Shell#test / Shell#[]

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument aka the "command" argument to Shell or Shelltest in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method...

DEBIAN-CVE-2021-45116

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a...

PYSEC-2022-2

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a...

CVE-2021-45116

CVE-2021-45116 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The issue stems from the Django Template Language variable resolution logic; the dictsort template filter could disclose information or trigger an unintended method call when given a crafted key. Remediation...

CVE-2021-45116

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a...

Deserialization Of Untrusted Data

pytorchlightning is vulnerable to deserialization of untrusted data. The vulnerability is due to an insecure method call in loadhparamsfromyaml function of savings.py which allows a malicious attacker to send malicious yaml config files, leading to remote code execution...

ruby: Code injection via command argument of Shell#test / Shell#[]

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument aka the "command" argument to Shell or Shelltest in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method...

Exploit for Incorrect Authorization in Polkit_Project Polkit

Polkit-exploit - CVE-2021-3560 Privilege escalation with polki...

CVE-2021-30179

Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API...

Anyone Can Call Init() and Lock It Forever For Attack.sol, DAO.sol, Factory.sol, Pools.sol, Router.sol, Vault.sol, and Vader.sol

Handle jvaqa Vulnerability details Impact Anyone Can Call Init and Lock It Forever For Attack.sol, DAO.sol, Factory.sol, Pools.sol, Router.sol, Vault.sol, and Vader.sol When trying to deploy vader contracts, an attacker could call init on each deployed contract and lock it, wasting the deployer's...

The vulnerability in web browsers Firefox, Firefox ESR, and the email client Thunderbird, related to a method call error in two identical documents, allows an attacker to access confidential data and compromise its integrity.

The vulnerability in web browsers Firefox, Firefox ESR, and the email client Thunderbird is related to a method call error in two identical documents. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise its integrity...

CVE-2019-10393

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call expressions allowed attackers to execute arbitrary code in sandboxed scripts...

jenkins-script-security-plugin: handling of method names in method call expressions allowed attackers to execute arbitrary code in sandboxed scripts

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call expressions allowed attackers to execute arbitrary code in sandboxed scripts...

jenkins-script-security-plugin: handling of method names in method call expressions allowed attackers to execute arbitrary code in sandboxed scripts

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call expressions allowed attackers to execute arbitrary code in sandboxed scripts...

CVE-2019-16255

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument aka the "command" argument to Shell or Shelltest in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method...

Improper Input Validation in simple_form

Incorrect Access Control in filemethod? in lib/simpleform/formbuilder.rb; a user-supplied string is invoked as a method call Impact For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example: erb...