Deserialization of untrusted data

Hertzbeat is a real-time monitoring system. At the interface of /define/yml, SnakeYAML is used as a parser to parse yml content, but no security configuration is used, resulting in a YAML deserialization vulnerability. Version 1.4.1 fixes this vulnerability...

The vulnerability of the Windows operating system’s kernel, which allows a hacker to bypass security restrictions

The vulnerability of the Windows operating system’s kernel is related to security configuration errors. Exploiting this vulnerability can allow a hacker to bypass security restrictions...

CVE-2023-6152

A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verifyemailenabled" will only validate email only on sign up...

The vulnerability of the isolated Sandbox software environment in the macOS operating system allows a intruder to gain unauthorized access to removable storage devices.

The vulnerability of the isolated Sandbox software environment in the macOS operating system is related to security configuration errors. Exploiting this vulnerability can allow a malicious individual to gain unauthorized access to removable storage devices...

Microsoft Edge’s vulnerability, related to security configuration errors, allows a hacker to bypass the sandbox protection mechanism and execute arbitrary code.

The vulnerability of Microsoft Edge relates to errors in security settings when processing HTML content. Exploiting this vulnerability allows a malicious actor to bypass sandbox protections and execute arbitrary code using a specially created file or web page...

Design/Logic Flaw

IBM Security Access Manager Container IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1 could allow a local user to escalate their privileges due to an improper security configuration. IBM X-Force ID: 254767...

CVE-2023-31005 IBM Security Access Manager Container privilege escalation

IBM Security Access Manager Container IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1 could allow a local user to escalate their privileges due to an improper security configuration. IBM X-Force ID: 254767...

CVE-2023-31005 IBM Security Access Manager Container privilege escalation

IBM Security Access Manager Container IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1 could allow a local user to escalate their privileges due to an improper security configuration. IBM X-Force ID: 254767...

BIT-LIFERAY-2023-33949

In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which allows remote attackers to create accounts using fake email addresses or email addresses which they don't control. The portal property...

Microsoft Edge’s vulnerability, related to security configuration errors, allows attackers to escalate their privileges.

The vulnerability of Microsoft Edge is related to security configuration errors. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...

The vulnerabilities of Mozilla Firefox, Firefox ESR, and the email client Thunderbird are related to security configuration errors, allowing attackers to circumvent existing security restrictions.

The vulnerabilities of Mozilla Firefox, Firefox ESR, and the email client Thunderbird are related to security configuration errors. Exploiting these vulnerabilities allows a malicious actor to bypass existing security restrictions using specially crafted browser prompts and dialog boxes...

CVE-2023-49657

A stored cross-site scripting XSS vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. For 2.X versions, users should change their...

The vulnerability of the DesktopServices component of the macOS operating system, which allows a hacker to bypass the Gatekeeper checks

The vulnerability of the DesktopServices component in the macOS operating system is related to security configuration errors. Exploiting this vulnerability could allow a hacker to bypass the Gatekeeper checks...

The vulnerability of the Messages component in the macOS operating system allows a hacker to disclose protected information.

The vulnerability of the Messages component in the macOS operating system is related to security configuration errors. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by the system’s security measures...

The vulnerability of the Emoji component in the macOS operating system allows a hacker to execute arbitrary code.

The vulnerability of the Emoji component in the macOS operating system is related to security configuration errors. Exploiting this vulnerability could allow a attacker to execute arbitrary code...

Vulnerabilities of Microsoft .NET Framework, .NET software platforms, and Microsoft Visual Studio development tools, related to security configuration errors, allow attackers to circumvent existing security restrictions.

The vulnerabilities of Microsoft’s software platforms, such as the .NET Framework, .NET, and Microsoft Visual Studio, are related to security configuration errors. Exploiting these vulnerabilities can allow attackers to circumvent existing security restrictions remotely...

The vulnerability in the implementation of the Kerberos protocol for Windows operating systems allows a perpetrator to circumvent security restrictions.

The vulnerability of the Kerberos protocol for Windows operating systems is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions remotely...

The vulnerability of the HTML platform for Windows operating systems, which allows a hacker to bypass security restrictions

The vulnerability of the HTML platform for Windows operating systems is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions remotely...

CVE-2024-0310

A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy...

PT-2024-14015

Name of the Vulnerable Software and Affected Versions savignano S/Notify versions prior to 4.0.2 for Confluence Description An issue was discovered that allows the configuration settings of S/Notify to be modified via a CSRF attack while an administrative user is logged on. This could be initiate...