GHSA-C4Q5-6C82-3QPW Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact an application, all of the following must be true: It must be a WebFlux application It must be using Spring's static resources support It...

Siemens SINEC Security Monitor 安全漏洞

SINEC Security Monitor is a modular network security software for passive, non-intrusive, continuous network security monitoring during production processes at customer sites. A Permitted Input Permit List vulnerability exists in Siemens SINEC Security Monitor, which arises from failure to proper...

CVE-2024-41736

Under certain conditions SAP Permit to Work allows an authenticated attacker to access information which would otherwise be restricted causing low impact on the confidentiality of the application...

CVE-2024-41736

Under certain conditions SAP Permit to Work allows an authenticated attacker to access information which would otherwise be restricted causing low impact on the confidentiality of the application...

CVE-2024-41736 Information Disclosure vulnerability in SAP Permit to Work

Under certain conditions SAP Permit to Work allows an authenticated attacker to access information which would otherwise be restricted causing low impact on the confidentiality of the application...

CVE-2024-41736 Information Disclosure vulnerability in SAP Permit to Work

Under certain conditions SAP Permit to Work allows an authenticated attacker to access information which would otherwise be restricted causing low impact on the confidentiality of the application...

CVE-2024-41736

The CVE-2024-41736 entry corresponds to an information disclosure vulnerability in SAP Permit to Work, exploitable by an authenticated attacker under certain conditions. The impact is described as low for confidentiality, with no impact to integrity or availability. Affected product: SAP Permit t...

SAP Permit to Work 信息泄露漏洞

SAP Permit to Work is a systematic solution from SAP, Germany, that provides a secure and efficient way to control and perform operations and maintenance activities in the workplace. An information disclosure vulnerability exists in SAP Permit to Work that originates from allowing an authenticate...

CVE-2024-41736: Exposure of Sensitive Information to an Unauthorized Actor

Under certain conditions SAP Permit to Work allows an authenticated attacker to access information which would otherwise be restricted causing low impact on the confidentiality of the application...

PT-2024-29546 · Sap · Sap Permit To Work

Name of the Vulnerable Software and Affected Versions: SAP Permit to Work affected versions not specified Description: The issue allows an authenticated attacker to access information that would otherwise be restricted, causing low impact on the confidentiality of the application. There is no...

PT-2024-14873 · Unknown · 7130 Series Fpga

Name of the Vulnerable Software and Affected Versions: 7130 Series FPGA platforms affected versions not specified Description: The issue affects the operation of Access Control Lists ACLs on the configured ports of the 7130 Series FPGA platforms. When ACLs are applied, some packets that should be...

CVE-2023-40362

An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023. Lack of access control protections allows remote attackers to arbitrarily delete the contractors from any user's account when the user ID and contractor information is known...

Design/Logic Flaw

An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023. Lack of access control protections allows remote attackers to arbitrarily delete the contractors from any user's account when the user ID and contractor information is known...

CVE-2023-40362

CVE-2023-40362 concerns CentralSquare Click2Gov Building Permit prior to October 2023, where a lack of authorization protections lets an attacker delete contractors from another user’s account if they know the victim’s user ID and contractor details. Connected sources confirm the vulnerability ex...

CVE-2023-40362: Missing Authorization

An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023. Lack of access control protections allows remote attackers to arbitrarily delete the contractors from any user's account when the user ID and contractor information is known...

PT-2023-27412 · Centralsquare · Centralsquare Click2Gov Building Permit

Name of the Vulnerable Software and Affected Versions: CentralSquare Click2Gov Building Permit versions prior to October 2023 Description: An issue was discovered in CentralSquare Click2Gov Building Permit, where lack of access control protections allows remote attackers to arbitrarily delete...

Signature malleability in permit function

Lines of code Vulnerability details Impact In the ERC20 contract used to define the interface for tranche tokens the permit function uses ecrecover to verify a signature submitted by the token owner to approve an address to spend its tranche tokens. However there is a well known issue related to...

H-05 Unmitigated

Lines of code Vulnerability details Issue not mitigated About the problem sponsor function allows caller to delegate his shares to the special address. In this case caller losses ability to win prizes. Previous version of code had sponsor function, which allowed to deposit funds on behalf of owne...

borrowInternal() of BaseTOFTMarketModule.sol has phantom permit functions

Lines of code Vulnerability details Impact A malicious actor could steal funds from a User who has already done his first deposit. Proof of Concept Consider the case where attacker uses a token with phantom permit function as collateral, the most famous ones being WETH, BNB, HEX etc. Let’s consid...

GHSA-F5X6-7QGP-JHF3 ecrecover can return undefined data if signature does not verify

Impact the ecrecover precompile does not fill the output buffer if the signature does not verify, see https://github.com/ethereum/go-ethereum/blob/b058cf454b3bdc7e770e2b3cec83a0bcb48f55ee/core/vm/contracts.goL188. however, the ecrecover builtin will still return whatever is at memory location 0...