MySQL Connectors takeover vulnerability

Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/J. Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful...

Qualys FIM Playbook for PCI 4.0

This File Integrity Monitoring FIM playbook is your comprehensive guide to establishing and maintaining an effective FIM program aligned with the latest PCI DSS 4.0 standards. By meticulously monitoring and ensuring the integrity of vital files and configurations, your organization can bolster it...

GHSA-G9V2-WQCJ-J99G Uptime Kuma has Persistentent User Sessions

Summary Attackers with access to a users' device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity-periods. Details uptime-kuma sets JWT tokens for users after successful authentication. These tokens have...

Uptime Kuma has Persistentent User Sessions

Summary Attackers with access to a users' device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity-periods. Details uptime-kuma sets JWT tokens for users after successful authentication. These tokens have...

CVE-2022-3916

CVE-2022-3916 affects Keycloak via the offline_access scope. The flaw arises from missing root-session validation and reuse of session IDs between root and user authentication sessions, enabling an attacker to resolve a user session attached to a previously authenticated user; using the refresh t...

scope-films.com Cross Site Scripting vulnerability OBB-3655765

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

SUSE CVE-2020-21686

A stack-use-after-scope issue discovered in expandmmacparams function in preproc.c in nasm before 2.15.04 allows remote attackers to cause a denial of service via crafted asm file...

CVE-2020-21686

A stack-use-after-scope issue discovered in expandmmacparams function in preproc.c in nasm before 2.15.04 allows remote attackers to cause a denial of service via crafted asm file...

CVE-2020-21686

A stack-use-after-scope issue discovered in expandmmacparams function in preproc.c in nasm before 2.15.04 allows remote attackers to cause a denial of service via crafted asm file...

UBUNTU-CVE-2020-21686

A stack-use-after-scope issue discovered in expandmmacparams function in preproc.c in nasm before 2.15.04 allows remote attackers to cause a denial of service via crafted asm file...

CVE-2020-21686: Return of Stack Variable Address

A stack-use-after-scope issue discovered in expandmmacparams function in preproc.c in nasm before 2.15.04 allows remote attackers to cause a denial of service via crafted asm file...

CVE-2020-21686

CVE-2020-21686 is a stack-use-after-scope vulnerability in NASM’s preproc.c expand_mmac_params function, present in NASM releases before 2.15.04. It allows remote denial of service via a crafted ASM file. Multiple connected sources corroborate the issue and note a security update; remediation is ...

CVE-2020-21686

A stack-use-after-scope issue discovered in expandmmacparams function in preproc.c in nasm before 2.15.04 allows remote attackers to cause a denial of service via crafted asm file...

OSV-2023-715 Stack-use-after-scope in ulocimp_addLikelySubtags_74

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61582 Crash type: Stack-use-after-scope READ 3 Crash state: ulocimpaddLikelySubtags74 ulocisRightToLeft74 ulocisrighttoleftfuzzer.cpp...

PT-2023-35960

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A crash has been reported, identified as a Stack-use-after-scope READ 3 type. The crash involves the ulocimp addLikelySubtags 74 and uloc isRightToLeft 74...

icu:uloc_is_right_to_left_fuzzer: Stack-use-after-scope in ulocimp_addLikelySubtags_74

Project: https://github.com/unicode-org/icu.git Detailed Report: https://oss-fuzz.com/testcase?key=4747793473077248 Project: icu Fuzzing Engine: libFuzzer Fuzz Target: ulocisrighttoleftfuzzer Job Type: libfuzzerasanicu Platform Id: linux Crash Type: Stack-use-after-scope READ 3 Crash Address:...

Exposure of system-scoped credentials in maven-artifact-choicelistprovider

maven-artifact-choicelistprovider 1.14 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration. This allows attackers with Item/Configure permission to access and capture credentials the...

CVE-2023-40256

A vulnerability was discovered in Veritas NetBackup Snapshot Manager before 10.2.0.1 that allowed untrusted clients to interact with the RabbitMQ service. This was caused by improper validation of the client certificate due to misconfiguration of the RabbitMQ service. Exploiting this impacts the...

Privilege Escalation

sentry is vulnerable to Privilege Escalation. An authenticated attacker is able to take advantage of an access token with a restricted scope by requesting a list of all user-created tokens, including those with wider scopes from the /api/0/api-tokens/ endpoint, resulting in privilege escalation...

GHSA-9JCQ-JF57-C62C Privilege escalation via ApiTokensEndpoint

Impact An attacker with access to a token with few or no scopes can query /api/0/api-tokens/ for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests. There is no evidence that the issue was exploited on https://sentry.io. For...