6006 matches found
CVE-2014-5245
CVE-2014-5245 affects Symfony HttpKernel (2.2.x–2.5.x) where FragmentHandler treats all ESI render requests as trusted when behind a proxy, enabling potential exposure of fragment data. Root cause: inability to distinguish legitimate ESI requests from proxy from direct client requests. Impact: Se...
CVE-2015-2309
The CVE-2015-2309 entry corresponds to Symfony HTTP Foundation’s unsafe Request handling. The issue arises in Symfony’s Request class, which assumes the remote address is trusted if any proxy is trusted, allowing a man-in-the-middle scenario. Affected are Symfony HttpFoundation versions 2.0.x thr...
CVE-2014-6072
CVE-2014-6072 concerns the Symfony WebProfiler import/export feature. The connected documents indicate a CSRF-protected form that accepts PHP-serialized profiler data, which can be crafted to inject code via unserialize, leading to potential code injection. Affected versions are Symfony WebProfil...
WordPress Organization chart Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)
Software Organization chart Type Plugin Vulnerable versions = 1.4.4 Fixed in 1.4.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-24387 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 0fde8648ea22 Credits yuyudhn Required...
Organization Chart < 1.4.5 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
WordPress Organization chart Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF)
Software Organization chart Type Plugin Vulnerable versions = 1.4.4 Fixed in 1.4.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-24384 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 3c7c36f42e17 Credits yuyudhn Required...
Integer Underflow
openvswitch is vulnerable to integer underflow. The vulnerability exists in Organization Specific TLV which allows an attacker to cause an integer underflow...
Out-Of-Bound Reads
openvswitch is vulnerable to out-of-bounds reads. The vulnerability exists in Organization Specific TLV which allows an attacker to cause an application crash or code execution...
OESA-2023-1042 openvswitch security update
Open vSwitch is a production quality, multilayer virtual switch licensed under the open source Apache 2.0 license. Security Fixes: An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch.CVE-2022-4338...
OESA-2023-1043 openvswitch security update
Open vSwitch is a production quality, multilayer virtual switch licensed under the open source Apache 2.0 license. Security Fixes: An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch.CVE-2022-4338...
TLS Connection Cryptographic Protocol Vulnerabilities
TLS is the backbone of encryption and key to ensuring data integrity, but its misconfiguration can leave your system vulnerable. Read on to discover how to secure your TLS connection and arm your organization against malicious attacks...
stRSR.seizeRSR() should check whether the basket of collateral is defaulted
Lines of code Vulnerability details Impact Backing Manager can seize RSR anytime and not within reason. RSR stakers will lose their funds. Proof of Concept Protocol states that staked RSR can be seized in the case of a collateral default, in a process that is entirely mechanistic based on on-chai...
CVE-2022-47966: Rapid7 Observed Exploitation of Critical ManageEngine Vulnerability
Emergent threats evolve quickly, and as we learn more about this vulnerability, this blog post will evolve, too. Rapid7 is responding to various compromises arising from the exploitation of CVE-2022-47966, a pre-authentication remote code execution RCE vulnerability impacting at least 24 on-premi...
voa.org Open Redirect vulnerability OBB-3157943
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2022-23739
An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of privileges in GraphQL API requests from GitHub Apps. This vulnerability allowed an app installed on an organization to gain access to and modify most organization-level resources that a...
CVE-2022-23739
An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of privileges in GraphQL API requests from GitHub Apps. This vulnerability allowed an app installed on an organization to gain access to and modify most organization-level resources that a...
Authorization
An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of privileges in GraphQL API requests from GitHub Apps. This vulnerability allowed an app installed on an organization to gain access to and modify most organization-level resources that a...
Gartner® Report: Questions to Ask When Selecting an MDR Provider
Measuring against the right criteria The “right” criteria is whatever works to further your security organization’s specific needs in detection and response D&R. There’s only so much budget to go around—and successfully obtaining a significant year-over-year increase can be rare. The last thing...
PT-2023-12733 · Github · Github Enterprise Server
Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.7.1 Description: An incorrect authorization issue was identified, allowing for escalation of privileges in GraphQL API requests from GitHub Apps. This issue enabled an app installed on an...
