3297 matches found
swift-nio-http2 安全漏洞
swift-nio-http2 is a SwiftPM project that can be built and tested very easily. A security vulnerability exists in swift-nio-http2 version 1.0.0 up to and including version 1.20, which stems from a logic error when an application parses an HTTP/2 header or an HTTP/2 PUSHPROMISE frame, which contai...
Check if a value is in an array before a push
This issue has been created to upgrade a QA report submission to a medium severity finding. From Dravee: Check if a value is in an array before a push In NestedRecords.sol's store function, it's possible to push an existing address token several times in the same array File: NestedRecords.sol 130...
CVE-2021-44166
An improper access control vulnerability CWE-284 in FortiToken Mobile Android external push notification 5.1.0 and below may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the...
CVE-2021-44166
An improper access control vulnerability CWE-284 in FortiToken Mobile Android external push notification 5.1.0 and below may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the...
CVE-2021-44166
An improper access control vulnerability CWE-284 in FortiToken Mobile Android external push notification 5.1.0 and below may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the...
CVE-2021-44166
An improper access control vulnerability CWE-284 in FortiToken Mobile Android external push notification 5.1.0 and below may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the...
CVE-2021-44166
Summary: CVE-2021-44166 affects Fortinet FortiToken Mobile for Android (external push notification, versions ≤ 5.1.0). The root cause is an improper access control (CWE-284) that could allow a remote attacker who already has a user’s password to access the protected system during the 2FA flow, ev...
PT-2022-12006
Name of the Vulnerable Software and Affected Versions FortiToken Mobile Android versions 5.1.0 and below Description An improper access control issue may allow a remote attacker, who has already obtained a user's password, to access the protected system during the 2FA procedure, even if the deny...
JetBrains TeamCity Access Control Error Vulnerability (CNVD-2022-18624)
JetBrains TeamCity is a distributed build management and continuous integration tool from JetBrains Jetbrains. An access control error vulnerability exists in JetBrains TeamCity, which stems from the fact that the product does not effectively restrict permissions for the Agent Push feature. An...
FortiToken Mobile (Android) - Deny request approved from External push notification
An improper access control vulnerability CWE-284 in FortiToken Mobile Android external push notification may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the legitimate user...
JetBrains TeamCity OS Command Injection Vulnerability Vulnerability
JetBrains TeamCity is a distributed build management and continuous integration tool from JetBrains Czech Republic. JetBrains TeamCity is vulnerable to an operating system command injection vulnerability that stems from a lack of filtering and escaping of system commands in the Agent Push feature...
CVE-2022-25263
JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration...
CVE-2022-25263
JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration...
Command injection
JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration...
CVE-2022-25263
JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration...
CVE-2022-25263
CVE-2022-25263 affects JetBrains TeamCity prior to 2021.2.3 and describes an OS command injection in the Agent Push feature configuration. The provided records consistently indicate this as a vulnerability in TeamCity, with multiple sources reiterating the same issue (lack of filtering/escaping o...
CVE-2022-24334
In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server...
CVE-2022-24334
In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server...