4336 matches found
NEXT ENGINE Integration Plugin 授权问题漏洞
NEXT ENGINE Integration Plugin is an integration plugin from NE Open Source. A security vulnerability exists in NEXT ENGINE Integration Plugin that stems from an authentication bypass vulnerability...
JVN#50862842: EC-CUBE plugin "NEXT ENGINE Integration Plugin (for EC-CUBE 2.0 series)" vulnerable to authentication bypass
EC-CUBE plugin "NEXT ENGINE Integration Plugin for EC-CUBE 2.0 series" provided by NE Inc. contains an authentication bypass vulnerability CWE-287. Impact A remote attacker may alter the information stored in the system. Solution Stop using "NEXT ENGINE Integration Plugin for EC-CUBE 2.0 series "...
CVE-2023-28961
An Improper Handling of Unexpected Data Type vulnerability in IPv6 firewall filter processing of Juniper Networks Junos OS on the ACX Series devices will prevent a firewall filter with the term 'from next-header ah' from being properly installed in the packet forwarding engine PFE. There is no...
Security Bulletin: The IBM® Engineering Lifecycle Engineering product using IBM Java XML vulnerability CVE-2022-21426, deferred from Oracle Apr 2022 CPU - CVE-2022-21426
Summary A flaw in the XML component may lead to excessive memory consumption when compiling certain XPath expressions, which may in turn allow an attacker to inflict a denial-of-service. Following IBM® Engineering Lifecycle Engineering products are vulnerable to this attack, it has been addressed...
Security Bulletin: The IBM® Engineering Lifecycle Engineering product using WebSphere Application Server Liberty is vulnerable to server-side request forgery due to Apache CXF - CVE-2022-46364
Summary IBM WebSphere Application Server Liberty is vulnerable to server-side request forgery due to Apache CXF. Following IBM® Engineering Lifecycle Engineering products are vulnerable to this attack, it has been addressed in this bulletin: Jazz Foundation, IBM Engineering Workflow Management, I...
Security Bulletin: IBM Engineering Requirements Management DOORS Next is vulnerable to XML external entity (XXE) attacks due to a vulnerability in XML processing in Apache Jena, in versions up to 4.1.0 (CVE-2021-39239)
Summary IBM Engineering Requirements Management DOORS Next is vulnerable to CVE-2021-39239 due to a vulnerability in XML processing in Apache Jena, in versions up to 4.1.0. Apache Jena is used by IBM Engineering Requirements Management DOORS Next for working with RDF models. The fix disables...
tinyTIFF 安全漏洞
TinyTIFF is a lightweight C/C++ library by Jan W. Krieger, a personal developer. It can read and write basic TIFF files. A security vulnerability exists in tinyTIFF v.3.0, which is caused by a buffer overflow problem on this system and can be exploited to cause a denial of service via the...
nextdayflyers.com Cross Site Scripting vulnerability OBB-3238431
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
UBUNTU-CVE-2023-1077
In the Linux kernel, picknextrtentity may return a type confused entry, not detected by the BUGON condition, as the confused entry will not be NULL, but listhead.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused...
CVE-2023-1457
A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. Affected is an unknown function of the component Static Routing Configuration Handler. The manipulation of the argument next-hop-interface leads to command injection. It is possible to launch the...
Ubiquiti EdgeRouter 命令注入漏洞
The Ubiquiti EdgeRouter is a router from Ubiquiti USA. A security vulnerability exists in Ubiquiti EdgeRouter X version 2.0.9-hotfix.6, which stems from an incorrect operation of the parameter next-hop-interface that can lead to command injection...
CVE-2023-1457: Improper Neutralization of Special Elements used in a Command
A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. Affected is an unknown function of the component Static Routing Configuration Handler. The manipulation of the argument next-hop-interface leads to command injection. It is possible to launch the...
next-mannheim.de Cross Site Scripting vulnerability OBB-3232362
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PT-2023-17857 · Google · Android Kernel
Name of the Vulnerable Software and Affected Versions: Android kernel affected versions not specified Description: In the fdt next tag function of fdt.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution...
Cross-Site Request Forgery (CSRF)
next-auth is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists due to the missing state, nonce, and PKCE checks for OAuth authentication, which allows an attacker to bypass the CSRF protection...
Missing proper state, nonce and PKCE checks for OAuth authentication
Impact next-auth applications using OAuth provider versions before v4.20.1 are affected. A bad actor who can spy on the victim's network or able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to log in as the victim, bypassing...
@chirpy-dev/analytics (0.0.1), @chirpy-dev/main-app (>=0.1.0, <=0.3.0) +16 more potentially affected by CVE-2023-27490 via next-auth (>=4.0.0-beta.6, <=4.19.2)
next-auth NPM version =4.0.0-beta.6, =0.1.0, =1.9.9, =4.0.0-alpha.11, =4.0.0-alpha.1, =4.0.0-alpha.6, =0.31.1, =1.42.1, =0.50.4, =0.1.0, =0.3.0, =1.0.0-beta.1, =1.0.0-beta.31, =2.3.0-beta.7, =2.4.0-beta.16 and more Source cves: CVE-2023-27490 Source advisory: OSV:GHSA-7R7X-4C4Q-C4QF...
GHSA-7R7X-4C4Q-C4QF Missing proper state, nonce and PKCE checks for OAuth authentication
Impact next-auth applications using OAuth provider versions before v4.20.1 are affected. A bad actor who can spy on the victim's network or able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to log in as the victim, bypassing...
BATLOADER Malware Uses Google Ads to Deliver Vidar Stealer and Ursnif Payloads
The malware downloader known as BATLOADER has been observed abusing Google Ads to deliver secondary payloads like Vidar Stealer and Ursnif. According to cybersecurity company eSentire, the malicious ads are used to spoof a wide range of legitimate apps and services such as Adobe, OpenAPI's ChatGP...
