Pimcore 跨站脚本漏洞

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce frameworks and product information management applications. A cross-site scripting vulnerability exists in...

WordPress RealHomes Theme <= 4.0.2 is vulnerable to Broken Access Control

Software RealHomes Type Theme Vulnerable versions = 4.0.2 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Broken Access Control CVE CVE-2023-37885 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 39bf9c0f0642 Credits Dave Jong Patchstack Required...

WordPress RealHomes Theme <= 4.0.2 is vulnerable to Broken Access Control

Software RealHomes Type Theme Vulnerable versions = 4.0.2 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Broken Access Control CVE CVE-2023-37886 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID bfa66703a763 Credits Dave Jong Patchstack Required...

Milesight UR32L urvpn_client function misconfiguration vulnerability

The Milesight UR32L is a 4G industrial router from China's Milesight. A misconfiguration vulnerability in the Milesight UR32L urvpnclient feature can be exploited by an attacker to perform a man-in-the-middle attack resulting in elevated privileges...

IBM Cloud Pak for Data 安全漏洞

IBM Cloud Pak for Data is a cloud-native solution from International Business Machines IBM that allows customers to use data and analyze it quickly and efficiently. A security vulnerability exists in IBM Cloud Pak for Data version 4.0 that stems from a misconfiguration of the security environment...

Sentry CORS misconfiguration

Impact The Sentry API incorrectly returns the access-control-allow-credentials: true HTTP header if the Origin request header ends with the system.base-hostname option of Sentry installation. This only affects installations that have system.base-hostname option explicitly set, as it is empty by...

GHSA-4XQM-4P72-87H6 Sentry CORS misconfiguration

Impact The Sentry API incorrectly returns the access-control-allow-credentials: true HTTP header if the Origin request header ends with the system.base-hostname option of Sentry installation. This only affects installations that have system.base-hostname option explicitly set, as it is empty by...

CVE-2023-36829 Sentry CORS misconfiguration vulnerability

Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the access-control-allow-credentials: true HTTP header if the Origin request header ends with the system.base-hostname option of Sentry...

CVE-2023-36829 Sentry CORS misconfiguration vulnerability

Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the access-control-allow-credentials: true HTTP header if the Origin request header ends with the system.base-hostname option of Sentry...

CVE-2023-23546

A misconfiguration vulnerability exists in the urvpnclient functionality of Milesight UR32L v32.3.0.5. A specially-crafted man-in-the-middle attack can lead to increased privileges. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...

CVE-2023-23546

A misconfiguration vulnerability exists in the urvpnclient functionality of Milesight UR32L v32.3.0.5. A specially-crafted man-in-the-middle attack can lead to increased privileges. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...

Privilege escalation

A misconfiguration vulnerability exists in the urvpnclient functionality of Milesight UR32L v32.3.0.5. A specially-crafted man-in-the-middle attack can lead to increased privileges. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...

CVE-2023-23546

A misconfiguration vulnerability exists in the urvpnclient functionality of Milesight UR32L v32.3.0.5. A specially-crafted man-in-the-middle attack can lead to increased privileges. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...

CVE-2023-23546

CVE-2023-23546 is a Milesight UR32L urvpn_client misconfiguration vulnerability. Talos identifies it as a pre-authentication/mitm-related issue enabling elevated privileges when an attacker can exploit weak certificate validation and related data handling. Public material details show multiple ch...

CVE-2023-23546

A misconfiguration vulnerability exists in the urvpnclient functionality of Milesight UR32L v32.3.0.5. A specially-crafted man-in-the-middle attack can lead to increased privileges. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...

PT-2023-19028 · Milesight · Milesight Ur32L

Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.5 Description: A misconfiguration issue exists in the urvpn client functionality, allowing a specially-crafted man-in-the-middle attack to lead to increased privileges. An attacker can exploit this by performing...

Milesight UR32L 信任管理问题漏洞

The Milesight UR32L is a 4G industrial router from China's Milesight. A misconfiguration vulnerability in the Milesight UR32L urvpnclient feature can be exploited by an attacker to perform a man-in-the-middle attack resulting in elevated privileges...

Samsung Internet 安全漏洞

SAMSUNG Internet is a cell phone application from Samsung South Korea. It provides a browser function. A security vulnerability exists in Samsung Internet prior to version 21.0.0.41, which stems from a misconfiguration that allows an attacker to bypass the SameSite cookie...

NO CHECK TO VERIFY THE ELEMENTS OF assetsAmounts[] ARRAY IS IN THE SAME ORDER AS assets[] ARRAY, IF MISCONFIGURED COULD BREAK THE INTERNAL ACCOUNTING OF SHARE CALCULATION

Lines of code Vulnerability details Impact In the ERC4626MultiToken.convertToShares function, assetsAmounts are used to calculate the shares to mint. Here the assetsAmounts are expected to be passed in the order of the assets array. If there is any misconfiguration in the order, then it will affe...

Code injection

tktchurch/website contains the codebase for The King's Temple Church website. In version 0.1.0, a Stripe API key was found in the public code repository of the church's project. This sensitive information was unintentionally committed and subsequently exposed in the codebase. If an unauthorized...