2513 matches found
Design/Logic Flaw
An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The client will perform TLS certificate verification of the malicious domain name instead of the original XMPP service domain, allowing the attack...
CVE-2018-18541
In Teeworlds before 0.6.5, connection packets could be forged. There was no challenge-response involved in the connection build up. A remote attacker could send connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download...
Lenovo Personal Cloud Storage命令注入漏洞
Lenovo Personal Cloud Storage is a cloud storage platform from Lenovo China.Lenovo Personal Cloud Storage is vulnerable to command injection. An attacker could use the vulnerability to execute operating system commands by sending spoofed packets to the device...
PT-2022-16974 · Argo Cd · Argo Cd
Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 2.3.4 Argo CD versions prior to 2.2.9 Argo CD versions prior to 2.1.15 Description: A vulnerability was found in Argo CD that allows an attacker to spoof error messages on the login screen when single sign on SSO is...
Lenovo Personal Cloud Storage 操作系统命令注入漏洞
Lenovo Personal Cloud Storage is a cloud storage platform from Lenovo China.Lenovo Personal Cloud Storage is vulnerable to command injection. An attacker could use the vulnerability to execute operating system commands by sending spoofed packets to the device...
GHSA-C82R-QG3W-Q5MV Apache Solr insecure inter-node communication
Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially crafted node name that does not exist as part of the cluster and point it to a malicious node. This can trick the nodes in cluster to believe that the malicious...
Stormshield Network Security 代码问题漏洞
Stormshield Network Security is a next-generation UTM Unified Threat Management firewall from Stormshield France. A security vulnerability exists in Stormshield Network Security SNS version 4.3.x up to and including 4.3.8, which stems from an event log entry in the ASQ sofbus lacbus plugin that...
kernel: sctp: Invalid chunks may be used to remotely remove existing associations
A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses...
kernel: sctp: Invalid chunks may be used to remotely remove existing associations
A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses...
CVE-2022-28345
The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. It incorrectly renders RTLO encoded URLs beginning with a non-breaking space, when there is a hash character in the URL. This technique allows a remote unauthenticated attacker to send legitimate looking links, appearing t...
Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2022-9260)
The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9260 advisory. - drm/i915: Flush TLBs before releasing backing store Tvrtko Ursulin Orabug: 33835812 CVE-2022-0330 - drm/i915: Reduce locking in execlist command...
Any User Can Call incrementWindow() by Using a Spoofed Contract
Lines of code Vulnerability details Impact The incrementWindow function is used to notify the splitter contract whenever funds are sent to the contract. Users who belong to the merkle tree are able to claim their set percentage allocation on each new window. However, it is possible to spoof a cal...
CVE-2021-39764
In Settings, there is a possible way to display an incorrect app name due to improper input validation. This could lead to local escalation of privilege via app spoofing with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions:...
CVE-2022-26269
Suzuki Connect v1.0.15 allows attackers to tamper with displayed messages via spoofed CAN messages...
CVE-2022-26269
Suzuki Connect v1.0.15 allows attackers to tamper with displayed messages via spoofed CAN messages...
CVE-2022-26269
Suzuki Connect v1.0.15 allows attackers to tamper with displayed messages via spoofed CAN messages...
Code injection
Suzuki Connect v1.0.15 allows attackers to tamper with displayed messages via spoofed CAN messages...
CVE-2022-26269
Suzuki Connect v1.0.15 allows attackers to tamper with displayed messages via spoofed CAN messages...
CVE-2022-26269
CVE-2022-26269 affects Suzuki Connect v1.0.15. The vulnerability enables an attacker to tamper with messages displayed by the system through spoofed CAN messages, compromising integrity of user-visible information. The available sources consistently describe the issue as a message-tampering vulne...
Snapt Aria has an unspecified vulnerability
Snapt Aria is an enterprise ADC solution from Snapt USA that provides a load balancer, web gas pedal, web application firewall WAF, global server load balancer GSLB, etc. A security vulnerability exists in Snapt Aria v12.8, which could be exploited by an unauthenticated attacker to send emails fr...