6007 matches found
Authentication Bypass
hail is is vulnerable to Authentication Bypass. The vulnerability is due to improper validation while handling OpenID Connect OIDC email addresses. This lack of verification of the user's email domain allows an attacker to manipulate their email address to match an organization's domain with...
cleancooking.org Cross Site Scripting vulnerability OBB-3823633
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PT-2023-8397 · Github · Github Enterprise Server
Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.8.13 GitHub Enterprise Server versions prior to 3.9.8 GitHub Enterprise Server versions prior to 3.10.5 GitHub Enterprise Server versions prior to 3.11.3 GitHub Enterprise Server versions prior to...
Hertzbeat Security Vulnerabilities
Hertzbeat is an open source real-time monitoring system from the dromara organization. A security vulnerability exists in Hertzbeat version 1.20 and earlier versions, which stems from the ability to bypass privilege authentication...
CVE-2023-46649
A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access. To exploit this, an organization needs to be converted from a user. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12...
CVE-2023-46649
A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access. To exploit this, an organization needs to be converted from a user. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12...
PT-2023-30140 · Github · Github Enterprise Server
Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions 3.7 through 3.7.18 GitHub Enterprise Server versions 3.8 through 3.8.11 GitHub Enterprise Server versions 3.9 through 3.9.6 GitHub Enterprise Server versions 3.10 through 3.10.3 GitHub Enterprise Server...
Exploit for Files or Directories Accessible to External Parties in Apache Struts
CVE-2023-50164 : Apache Struts 2 vulnerable Docker container...
CVE-2023-50459
CVE-2023-50459 corresponds to a Broken Access Control issue in the TYPO3 extension femanager (in2code). The connected advisories identify the vulnerable components as the check_edit_user component (improper access checks) and a missing backend access check, enabling an authenticated frontend user...
CVE-2023-3283
The connected Palo Alto advisory PA-CVE-2023-6789 details a stored XSS vulnerability in PAN-OS web interface. It allows a malicious authenticated read-write administrator to store a JavaScript payload via the web interface, which executes when viewed by an authenticated administrator, proxying al...
Spanish Police Nab Venezuelan Leader of Kelvin Security Hacker Group
By Waqas The arrested Venezuelan individual now faces charges including membership in a criminal organization, disclosure of secrets, computer damage, and money laundering. This is a post from HackRead.com Read the original post: Spanish Police Nab Venezuelan Leader of Kelvin Security Hacker Grou...
Generic Secret Disclosure
Most of the web applications rely on various public services to provide features to their users. In secure designs, consuming these private services will require authentication like API and private keys, username and password based credentials and similar sensitive data. Developers sometimes hard...
CVE-2023-37366
CVE-2023-37366 is a DoS flaw affecting Google Pixel cellular baseband/modem components. Public details from Pixel security bulletin map it to a DoS issue for Pixel devices (2023-12 patch level). An OSV entry confirms a root cause in cd_parseMsg of cd_codec.c where improper input validation can ca...
CVE-2023-6396
GitLab CE/EE is affected by CVE-2023-6396 due to XSS and ReDoS in Markdown via the Banzai pipeline when a member has admin_group_member permission, potentially allowing escalation (e.g., adding members with higher roles) and exposure of internal project details. The issue is tied to a bypass of C...
CVE-2023-43020
CVE-2023-43020 is evidenced in IBM bulletins as a denial-of-service vulnerability in IBM Db2 (including Db2 Connect Server) when processing a specially crafted query. Affected products span Db2 on Linux/UNIX/Windows (versions 10.5, 11.1, 11.5; Db2 Big SQL is also listed in related bulletins). The...
CVE-2023-6218
In Progress MOVEit Transfer versions released before 2022.0.9 14.0.9, 2022.1.10 14.1.10, 2023.0.7 15.0.7, a privilege escalation path associated with group administrators has been identified. It is possible for a group administrator to elevate a group members permissions to the role of an...
Privilege escalation
In Progress MOVEit Transfer versions released before 2022.0.9 14.0.9, 2022.1.10 14.1.10, 2023.0.7 15.0.7, a privilege escalation path associated with group administrators has been identified. It is possible for a group administrator to elevate a group members permissions to the role of an...
CVE-2023-42219
Exim MTA vulnerability CVE-2023-42219 is described in the connected Malwarebytes entry as allowing network-adjacent attackers to disclose sensitive information on affected installations of Exim. The article also notes that Exim is not likely to fix CVE-2023-42219 and suggests mitigations such as ...
CVE-2023-4822
A flaw was found in the Grafana enterprise package. Grafana is incorrectly assessing permissions to update global roles and role assignments, therefore, users with administrator permissions in one organization can change global role permissions and global role assignments. After successful...