95 matches found
XWiki Commons 安全漏洞
XWiki Commons is a technology library shared by several other top XWiki projects. A security vulnerability exists in XWiki Commons, which stems from the fact that any user can edit their own configuration file and inject code that will be executed with programmatic privileges...
PT-2022-26017
Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.4.1 Description The issue allows an already authenticated user to continue using the UI or API even after their account has been deactivated. Recommendations For versions prior to 2.4.1, update to version 2.4...
Aruba Networks ArubaOS and InstantOS Denial of Service Vulnerabilities
ArubaOS is the network operating system for Aruba Mobility Controllers, Mobility Masters, and controller-managed Access Points APs.InstantOS is an Arch Linux-based distribution. A denial of service vulnerability exists in Aruba Networks ArubaOS and InstantOS. The vulnerability stems from a progra...
Dell OpenManage Enterprise elevation of privilege vulnerability (CNVD-2022-42737)
Dell OpenManage Enterprise is an easy-to-use, one-to-many system management console for IT infrastructure management from Dell, Inc. The software enables cost-effective, comprehensive lifecycle management of Dell EMC PowerEdge servers from a single console. An elevation of privilege vulnerability...
Dell PowerScale OneFS Elevation of Privilege Vulnerability (CNVD-2022-32825)
Dell PowerScale OneFS is a PowerScale OneFS operating system that provides a horizontally scalable NAS. An elevation of privilege vulnerability exists in Dell PowerScale OneFS, which stems from an incorrect programmatic call to a high-level native procedure. A local attacker could exploit this...
Cisco SD-WAN Elevation of Privilege Vulnerability
Cisco SD-WAN is a highly secure cloud-scale architecture from Cisco USA that is open, programmable, and scalable. an elevation of privilege vulnerability exists in Cisco SD-WAN, which stems from an incorrect programmatic call to a high-level native procedure. An attacker could exploit the...
Microsoft Windows Installer 权限许可和访问控制问题漏洞
Microsoft Windows Installer is a component of the Windows operating system from Microsoft. It provides a standard basis for installing and uninstalling software. An elevation of privilege vulnerability exists in Microsoft Windows Installer. The vulnerability stems from an incorrect programmatic...
Frontrunning of setPerTokenWalletCap edge case
Lines of code Vulnerability details Impact The setPerTokenWalletCap function in WhitelistPeriodManager.sol contains a comment stating: Special care must be taken when calling this function There are no checks for perTokenWalletCap since it's onlyOwner, but it's essential that it should be = max l...
Google Android 竞争条件问题漏洞
Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability. The vulnerability stems from an incorrect programmatic call to an advanced local procedure. An attacker could use this vulnerability to cause a local...
WordPress WP Google Map plugin elevation of privilege vulnerability
WordPress plugin is a WordPress open source application plugin. WP Google Map plugin for WordPress version 1.8.0 and earlier has an elevation of privilege vulnerability that stems from an incorrect programmatic call to a high-level native procedure. An attacker could exploit the vulnerability to...
KnockOutlook - A Little Tool To Play With Outlook
"The best feeling is to win by knockout." - Nonito Donaire Overview KnockOutlook is a C project that interacts with Outlook's COM object in order to perform a number of operations useful in red team engagements. Command Line Usage metadata of every account search : search for the provided keyword...
JWT leak via Open Redirect in Programmatic access
Impact Using programmatic access on protected sites, one can get a signed login URL with pomeriumredirecturi set to an arbitrary URL. Then, if the user has already logged into Pomerium, they will be redirected to the specified pomeriumredirecturi with a JWT attached. This allows an outside attack...
Open Redirect
github.com/pomerium/pomerium is vulnerable to open redirect. When using programmatic login, it does not restrict a signed login URL to redirect a victim to the attacker’s site and eventually can cause a JWT leakage...
Continuing to Listen: Good News about the Security Update Guide API!
Based on user feedback we have simplified programmatic access to the security update data by removing the authentication and API-Key requirements when using the CVRF API. You will no longer have to log in to obtain a personal API key to access the data. Were happy to make this valuable public...
Continuing to Listen: Good News about the Security Update Guide API!
Based on user feedback we have simplified programmatic access to the security update data by removing the authentication and API-Key requirements when using the CVRF API. You will no longer have to log in to obtain a personal API key to access the data. We're happy to make this valuable public...
[SECURITY] Fedora 33 Update: yubihsm-shell-2.0.3-1.fc33
This package contains most of the components used to interact with the YubiHSM 2 at both a user-facing and programmatic level...
What's Next for Edge Delivery
Access to media through the internet is a huge part of how so many in the world are entertained, informed, and even educated nowadays. And 2020 has shined an even greater light on that fact as many around the world have needed to adjust to life during a pandemic. At Akamai, we saw traffic deliver...
Dell Encryption and Dell Endpoint Security Suite Elevation of Privilege Vulnerability
Dell Encryption and Dell Endpoint Security Suite are both products of Dell Inc.Dell Encryption is a data protection solution. Dell Encryption is a data protection solution that includes compliance management, authentication, disk data encryption, and port encryption.Dell Endpoint Security Suite i...
The vulnerability of the exec function in the npm-programmatic package manager NPM allows a hacker to execute arbitrary code.
The vulnerability of the exec function in the npm-programmatic package manager NPM is related to the lack of security measures for handling web page structures. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially crafted malicious package...