CVE-2024-45919

A security flaw has been discovered in Solvait version 24.4.2 that allows an attacker to elevate their privileges. By manipulating the Request ID and Action Type parameters in /AssignToMe/SetAction, an attacker can bypass approval workflows leading to unauthorized access to sensitive information ...

CVE-2024-45919: Improper Privilege Management

A security flaw has been discovered in Solvait version 24.4.2 that allows an attacker to elevate their privileges. By manipulating the Request ID and Action Type parameters in /AssignToMe/SetAction, an attacker can bypass approval workflows leading to unauthorized access to sensitive information ...

CVE-2024-45919

A security flaw in Solvait version 24.4.2 allows for privilege elevation . An attacker can manipulate the Request ID and Action Type parameters in the /AssignToMe/SetAction API endpoint to bypass approval workflows. This vulnerability can lead to unauthorized access to sensitive information or th...

VulnCheck KEV: CVE-2024-31750

SQL injection vulnerability in f-logic datacube3 v.1.0 allows a remote attacker to obtain sensitive information via the reqid parameter...

CVE-2024-4886

The contains an IDOR vulnerability that allows a user to comment on a private post by manipulating the ID included in the request...

F-logic DataCube3 安全漏洞

F-logic DataCube3 is a small measurement terminal system from F-logic Japan. A security vulnerability exists in F-logic DataCube3 version v.1.0, which stems from a SQL injection vulnerability in the reqid parameter...

SUSE-SU-2023:4513-1 Security update for apache2-mod_jk

This update for apache2-modjk fixes the following issues: Update to version 1.2.49: Apache Retrieve default request id from moduniqueid. It can also be taken from an arbitrary environment variable by configuring 'JkRequestIdIndicator'. Don't delegate the generatation of the response body to httpd...

Exploit for Out-of-bounds Write in Haxx Libcurl

PoC exploit for CVE-2023-38545, a heap buffer overflow vulnerabi...

Dex vulnerable to Man-in-the-Middle allowing ID token capture via intercepted authorization code

Impact Dex instances with public clients and by extension, clients accepting tokens issued by those Dex instances are affected by this vulnerability. An attacker can exploit this vulnerability by making a victim navigate to a malicious website and guiding them through the OIDC flow, stealing the...

CVE-2022-31982

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=requests/viewrequest&id=...

Shopify: Reflected XSS online-store-git.shopifycloud.com

Summary: Hello, I hope you are having a good day!, There is a feature called "Shopify Github Integration", it helps to associate a GitHub account to a Shopify store. In the Github connection proccess there is a URL https://online-store-git.shopifycloud.com which is vulnerable to XXS reflected...

WordPress 插件 SQL注入漏洞

WordPress Plugin is an open source application plugin for WordPress. A SQL injection vulnerability exists in WordPress Plugin WordPress Membership SwiftCloud.io, which stems from the failure of the Get request ID parameter in the product /wp-admin/admin.php?page to properly check user input data...

Radancy: x-request-id header reflected in server response without sanitization

Domain and URL: maximum.nl Summary: When issuing a GET request to maximum.nl, its possible to set the x-request-id header which is then reflected in the server response without any sanitization. Description: An attacker can use this vulnerability to escalate to more advanced attacks such as CRLF...

CVE-2019-15592

GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline...

CVE-2019-15592

GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline...

CVE-2019-15592

GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline...

CVE-2019-15592: Exposure of Sensitive Information to an Unauthorized Actor

GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline...

PT-2020-9722 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.2.2 and earlier Description: The issue allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline. Recommendations: For GitLab versions 12.2.2 and earlier, update t...

Information Leakage Through Denial Of Service (DoS)

github.com/ gammazero/nexus is vulnerable to information leakage through denial of service attacks. The router can reassign call results to the wrong session when two clients are connecting concurrently and performing long running calls with the same request ID, resulting in denial of service...

CVE-2019-6606

On BIG-IP 11.5.1-11.6.3.4, 12.1.0-12.1.3.7, 13.0.0-13.1.1.3, and 14.0.0-14.0.0.2, when processing certain SNMP requests with a request-id of 0, the snmpd process may leak a small amount of memory...