The vulnerability of the Apache Kafka message dispatcher, related to deficiencies in access control, allows attackers to bypass security restrictions.

The vulnerability of the Apache Kafka message dispatcher is related to deficiencies in access control when using an Access Control List. Exploiting this vulnerability allows a malicious actor to bypass security restrictions through a specially created request...

Google Chromium PopupBlocker Security Bypass Vulnerability

Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome,...

CVE-2013-1891

In OpenCart 1.4.7 to 1.5.5.1, implemented anti-traversal code in filemanager.php is ineffective and can be bypassed...

GHSA-298J-9Q4W-6RM4 Agent-to-controller security bypass in Jenkins xUnit Plugin

xUnit Plugin 3.0.8 and earlier implements an agent-to-controller message that creates a user-specified directory if it doesn’t exist, and parsing files inside it as test results. This allows attackers able to control agent processes to create an arbitrary directory on the Jenkins controller or to...

Agent-to-controller security bypass in Jenkins xUnit Plugin

xUnit Plugin 3.0.8 and earlier implements an agent-to-controller message that creates a user-specified directory if it doesn’t exist, and parsing files inside it as test results. This allows attackers able to control agent processes to create an arbitrary directory on the Jenkins controller or to...

CVE-2022-34175

Jenkins 2.335 through 2.355 both inclusive allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments containing sensitive information, bypassing any permission checks in the corresponding view...

The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition, related to deficiencies in the authentication process, allows attackers to circumvent existing security restrictions.

The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions when using trigger...

Security Bulletin: Rational Team Concert (RTC) and IBM Engineering Workflow Management (EWM) OpenSSL vulnerability CVE-2021-4044

Summary There is a vulnerability CVE-2021-4044 which affects Rational Team Concert RTC and IBM Engineering Workflow Management EWM. Vulnerability Details CVEID:CVE-2021-4044 DESCRIPTION: OpenSSL could allow a remote attacker to bypass security restrictions, caused by invalid handling of...

KLA12590 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, bypass security restrictions. Below is a complete list of vulnerabilities: 1. Use after free vulnerability in PDF can be exploited to cause...

The vulnerability of the Local Security Authority Subsystem Service (LSASS) in the Windows operating system allows a hacker to bypass security restrictions and increase their privileges.

The vulnerability of the Local Security Authority Subsystem Service LSASS in the Windows operating system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to bypass security restrictions and increase their privileges...

Vulnerabilities fixed in Splunk products

Vulnerabilities have been fixed in Splunk products. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Bypassing authentication Bypassing security measure Remote code execution Administrator/Root rights Accessing...

CVE-2022-30164

Kerberos AppContainer Security Feature Bypass Vulnerability...

Vulnerabilities fixed in SAP products

Vulnerabilities have been fixed in several SAP products. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Cross-Site Request Forgery XSRF. Cross-Site Scripting XSS. Denial-of-Service DoS. Bypassing authentication...

VulnCheck KEV: CVE-2021-43226

Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms...

Security Bulletin: Vulnerabilities in Golang Go, OpenSSL, Python, and XStream affect IBM Spectrum Copy Data Management

Summary Vulnerabilities in Golang Go, OpenSSL, Python, and XStream, such as bypassing security restrictions and denial of service, may affect IBM Spectrum Copy Data Management. Vulnerability Details CVEID:CVE-2021-44716 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by an...

Authorization

Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0...

KLA12554 Multiple vulnerabilities in Apache HTTP Server

Multiple vulnerabilities were found in Apache HTTP Server. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Out of bounds read vulnerability in aprwrite can be...

https://huntr.dev/bounties/582cb14b-b2a8-4064-91c5-b580ff69ba07/ fix bypass; XSS via improper input validation of \t and lone \n character

Description I read this report https://huntr.dev/bounties/582cb14b-b2a8-4064-91c5-b580ff69ba07/ and noticed \t and lone \n is also missing from the filter list in the regex URL replace/\r?\n|\r/gm, "" All instances of \r \n and \t should be cleaned, but the filter list only checks for \r\n or \r...

Run malicious JS code with other kinds of encoding

Description We can Run malicious JS code With special escaping characters for ASCII chars that start with \x and also all Unicodes start with \u, like the followings : CR == \x0d and \u000d LF == \x0a and \u000a TAB == \t and \u0009 and \x09 So there can be many characters that we can't filter al...

The vulnerability of the File System API interfaces in Microsoft Edge and Google Chrome browsers allows attackers to circumvent established security restrictions.

The vulnerability of the File System API interfaces in Microsoft Edge and Google Chrome is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions set by the user through a specially created website...