4718 matches found
CVE-2020-8228
A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times...
CVE-2020-8228
A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times...
CVE-2020-8228
CVE-2020-8228 describes a missing rate limit on the signup page in the Nextcloud Preferred Providers app (version 1.7.0), allowing an attacker to repeatedly set the password. The OpenSUSE security advisory (NC-SA-2020-033) and related OSS notes confirm this CVE and indicate it was addressed in th...
PT-2020-20040
Name of the Vulnerable Software and Affected Versions Preferred Providers app version 1.7.0 Description A missing rate limit in the Preferred Providers app allowed an attacker to set the password an uncontrolled amount of times. Recommendations For version 1.7.0, consider implementing a rate limi...
CVE-2020-12506
Improper Authentication vulnerability in WAGO 750-8XX series with FW version = FW03 allows an attacker to change the settings of the devices by sending specifically constructed requests without authentication This issue affects: WAGO 750-362, WAGO 750-363, WAGO 750-823, WAGO 750-832/xxx-xxx, WAGO...
libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default.
...
CVE-2020-5605
Directory traversal vulnerability in WHR-G54S firmware 1.43 and earlier allows an attacker to access sensitive information such as setting values via unspecified vectors...
CVE-2020-0375
In Telephony, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege and the setting of supported EUICC countries with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...
USN-4510-2 samba vulnerability
USN-4510-1 fixed a vulnerability in Samba. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Tom Tervoort discovered that the Netlogon protocol implemented by Samba incorrectly handled the authentication scheme. A remote attacker could use this issue t...
CVE-2020-10718
A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Thread Context Classloader TCCL. This setting is exposed as a public method, which can bypass the security manager. The highest threat from this vulnerability is ...
My-CTF-Web-Challenges
It is an offensive tool for web exploitation. The repository contains a collection of web challenges created by the user 'orange'. The challenges are designed to test various web exploitation techniques, including SQL injection, cross-site scripting XSS, and authentication bypass. The challenges...
PT-2020-15878 · Tenda · Tenda Ac18 Router
Name of the Vulnerable Software and Affected Versions: Tenda AC18 Router versions through V15.03.05.05 EN Tenda AC18 Router versions through V15.03.05.196318 CN Description: The issue is related to incorrect authentication handling of the logincheck function in the /usr/lib/lua/ngx authserver/ngx...
Authentication Bypass
dweeves/magmi is susceptible to authentication bypass. It is possible because it uses a default login magmi:magmi basic authentication when a database connection failure is introduced by a malicious user by sending 151 simultaneous requests to the Magento website, leading to a "Too many...
CVE-2020-24394
In the Linux kernel before 5.7.8, fs/nfsd/vfs.c in the NFS server can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered...
Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns logging statements were made on the wrong connection causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers.
...
Foxit Reader 3.1.0.0111 < 3.2 Privilege Escalation (macOS)
The version of Foxit Reader for Mac installed on the remote macOS host is 3.1.0.0111. It is, therefore, affected by a privilege escalation vulnerability due to incorrect permission setting. An attacker could exploit this by modifying the dynamic libraries in the Plugins directory. Note that Nessu...
CVE-2015-8032
In Textpattern 4.5.7, an unprivileged author can change an article's markup setting...
Design/Logic Flaw
In Textpattern 4.5.7, an unprivileged author can change an article's markup setting...
CVE-2015-8032
In Textpattern 4.5.7, an unprivileged author can change an article's markup setting...
CVE-2015-8032
CVE-2015-8032 affects Textpattern 4.5.7. The vulnerability allows an unprivileged author to change an article's markup setting, indicating a permission/ownership flaw in how article markup is managed. The provided sources do not specify an exploit method or a patch/mitigation. The impact is limit...