CVE-2019-16742

CVE-2019-16742 is referenced in connected documents related to hashicorp Nomad: Veracode notes an authorization bypass where allocation endpoints improperly perform ACL checks on the requested namespace, enabling potential unauthorized access. No explicit patch/version details or remediation step...

CVE-2019-17591

Bolt CMS 3.x contains a CSRF vulnerability (CVE-2019-17591) demonstrated by public exploits targeting Bolt CMS 3.6.10. The exploit describes an authenticated user CSRF payload that posts to /index.php/async/folder/create to perform actions on behalf of the user. Connected sources show CSRF risk i...

CVE-2019-14803

CVE-2019-14803 is connected to a privilege-escalation issue in HashiCorp Nomad via the exec driver, caused by improper setuid permissions. The Veracode entry confirms Nomad as affected and notes the root cause as the exec driver having improper setuid permissions. No exploit/vector details are pr...

CVE-2019-14803

This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

CVE-2019-15928

HashiCorp Nomad is reported vulnerable to privilege escalation via the raw_exec driver being invoked even when disabled on the client, allowing an authorized user to run a task with higher privileges. The exact affected versions, root cause details, and remediation are not specified in the provid...

CVE-2021-31603

CVE-2021-31603 is a reserved candidate in the initial document; connected Veracode data indicates a vulnerability in croc where a remote attacker can intercept and decrypt all files sent via croc, constituting information disclosure. No product version, vector details, or remediation are provided...

CVE-2020-17455

Veracode reports CVE-2020-17455 as a remote code execution vulnerability in vault:edge, arising from a buffer overflow in the libntlm NTLM library. The flaw occurs in buildSmbNtlmAuthRequest_userlen() when input length is not properly validated, potentially allowing a crafted request to crash the...

Racoon Stealer is Back — How to Protect Your Organization

The Racoon Stealer malware as a service platform gained notoriety several years ago for its ability to extract data that is stored within a Web browser. This data initially included passwords and cookies, which sometimes allow a recognized device to be authenticated without a password being...

CVE-2022-31168

Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who...

Authorization

Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who...

CVE-2022-31168 Zulip Server insufficient authorization for changing bot roles

Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who...

CVE-2022-31168 Zulip Server insufficient authorization for changing bot roles

Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who...

CVE-2022-31168 Zulip Server insufficient authorization for changing bot roles

Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who...

petsaversshreveport.org Cross Site Scripting vulnerability OBB-2799652

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

globalasia.org Cross Site Scripting vulnerability OBB-2790218

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

[SECURITY] Fedora 35 Update: asnip-0-0.6.20200618git44ba98b.fc35

Asnip retrieves all IPs used by an organization for surface mapping. It uses the IP or domain name and looks up the Autonomous System Number ASN, retrieves the Classless Inter-Domain Routing CIDR subnet masks and converts them to IPs...

CVE-2021-27294

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

cscda.org Cross Site Scripting vulnerability OBB-2767418

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Stripe: Mass account takeover!

@akashhamal0x01 discovered an Organization Owner could update the email address of a member of their organization in TaxJar. This could have allowed an attacker to take over a victim’s account if the victim belonged to the attacker’s organization. The vulnerability was caused by the ability to ed...

mavoisatum.org Cross Site Scripting vulnerability OBB-2762101

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...