Design/Logic Flaw

Spinnaker is an open source, multi-cloud continuous delivery platform. Spinnaker has improper permissions allowing pipeline creation & execution. This lets an arbitrary user with access to the gate endpoint to create a pipeline and execute it without authentication. If users haven't setup...

CVE-2021-43832 Improper Access Control in spinnaker

Spinnaker is an open source, multi-cloud continuous delivery platform. Spinnaker has improper permissions allowing pipeline creation & execution. This lets an arbitrary user with access to the gate endpoint to create a pipeline and execute it without authentication. If users haven't setup...

CVE-2021-43832 Improper Access Control in spinnaker

Spinnaker is an open source, multi-cloud continuous delivery platform. Spinnaker has improper permissions allowing pipeline creation & execution. This lets an arbitrary user with access to the gate endpoint to create a pipeline and execute it without authentication. If users haven't setup...

CVE-2021-43832

CVE-2021-43832 applies to Spinnaker, where improper permissions allow an arbitrary user with gate-endpoint access to create and execute pipelines without authentication. If RBAC is not configured across all accounts/applications, this enables remote execution and deploying resources on any accoun...

CVE-2021-45980

Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via getURL in the JavaScript API...

CVE-2021-45978

Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via xfa.host.gotoURL in the XFA API...

Code injection

Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via getURL in the JavaScript API...

Code injection

Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via xfa.host.gotoURL in the XFA API...

PT-2022-15002 · Unknown · Codeigniter4

Name of the Vulnerable Software and Affected Versions: CodeIgniter4 versions prior to 4.1.6 Description: Deserialization of Untrusted Data was found in the old function in CodeIgniter4. Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, and possibly execute...

The vulnerability of the Active Directory Domain Controller component of the Samba networking software allows a perpetrator to execute arbitrary code.

The vulnerability of the Active Directory Domain Controller component in the Samba networking software package arises due to a buffer overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

The vulnerability of the configuration management system and remote execution capabilities of SaltStack Salt allows attackers to execute arbitrary commands by exploiting errors in the authentication processing for expired eauth tokens.

The vulnerability of the Configuration Management system and the remote execution of operations in SaltStack Salt is related to errors in processing authentication requests for expired eauth tokens. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability of SCADA systems with integrated web servers, related to the lack of file download restrictions, allows intruders to execute arbitrary code.

The vulnerability of SCADA systems with integrated web servers relates to the lack of restrictions on file downloads. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

RHEL 7 : telnet (RHSA-2022:0011)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0011 advisory. Telnet is a popular protocol for logging in to remote systems over the Internet. The telnet-server packages include a telnet service that supports...

in gpac/gpac

Description Null Pointer Dereference in gfutf8wcslen Proof of Concept POC is here. bt Program received signal SIGSEGV, Segmentation fault. ----------------------------------registers----------------------------------- RAX: 0x24 '$' RBX: 0x5555555e2870 -- 0x5555555e2840 -- 0x2000000020000000 '' RC...

Unspecified Vulnerability in Printchaser

Printchaser is a solution from Informer Technologies that enables companies to sense and track the dangers of unauthorized information outflow by applying print log management and monitoring as well as inserting watermarks into printouts from office PCs. Printchaser has a security vulnerability...

CVE-2021-45425

Reflected Cross Site Scripting XSS in SAFARI Montage versions 8.3 and 8.5 allows remote attackers to execute JavaScript codes...

CVE-2021-43857

Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in version 0.9.8...

ROS-2-2020

2.2020 Vulnerability in SpamAssassin spam filtering tool CVE-2020-1946 1. Vulnerability Description: CVE-2020-1946 A vulnerability in the SpamAssassin spam filtering tool, is related to improper input validation when processing rule configuration .cf files. Exploitation of the vulnerability could...

The vulnerability of the `salt.utils.thin.gen_thin()` function in the configuration management system and remote execution of SaltStack Salt operations allows a attacker to execute arbitrary commands on the target system.

The vulnerability of the salt.utils.thin.genthin function in the configuration management system and for remote execution of SaltStack Salt is related to insufficient validation of arguments passed in commands. Exploiting this vulnerability could allow a malicious actor to execute arbitrary...

The vulnerability of the configuration management system and the remote execution feature of SaltStack Salt allow a perpetrator to execute arbitrary commands with elevated privileges.

The vulnerability of the Configuration Management system and the remote execution of operations in SaltStack Salt is related to errors in the processing of input data in the ssh-client salt-api. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with elevated...