CVE-2023-4008

Removed by vendor...

CVE-2023-4008 Incorrect Ownership Assignment in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to takeover GitLab Pages with unique domain URLs if the random string added was known...

PT-2023-21198 · Cloudflare · Cloudflare Warp Client For Windows

Name of the Vulnerable Software and Affected Versions: Cloudflare WARP client for Windows affected versions not specified Description: The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, as it acts as a local DNS server that performs DNS queries in a secure...

Identifying publications using its ID makes the protocol vulnerable to blockchain re-orgs

Lines of code Vulnerability details Bug Description In the protocol, publications are uniquely identified through the publisher's profile ID and the publication's ID. For example, when a user calls act, the publication being acted on is determined by publicationActedProfileId and...

CVE-2023-38495

creationtimestamp| type| source ---|---|--- 2023-07-27 22:28:49+00:00| seen| https://t.me/cibsecurity/67346 2026-07-08 04:00:06+00:00| seen| https://t.me/thepirates3a/871 2026-07-09 00:00:06+00:00| seen| https://t.me/thepirates3a/871 2026-07-11 19:00:05+00:00| seen| https://t.me/thepirates3a/871...

Replay Attack Vulnerability Due to Uniqueness Invariant Violation in AxelarServiceGovernance Contract's Proposal Hash Generation

Lines of code Vulnerability details Impact The current implementation of the AxelarServiceGovernance contract relies solely on the Keccak256 algorithm to generate proposal hashes, using only the target contract's address, encoded function call data, and the native token transfer value as...

grafana: account takeover possible when using Azure AD OAuth

A flaw was found in Grafana, which validates Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique across Azure AD tenants, which enables Grafana account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant AzureAD OAuth...

CVE-2022-48516

Vulnerability that a unique value can be obtained by a third-party app in the DSoftBus module. Successful exploitation of this vulnerability will affect confidentiality...

PT-2023-15842 · Dsoftbus · Dsoftbus

Name of the Vulnerable Software and Affected Versions: DSoftBus affected versions not specified Description: The issue allows a third-party app to obtain a unique value in the DSoftBus module, affecting confidentiality. There is no information provided about the estimated number of potentially...

CVE-2023-31999

All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purpose of the Oauth2 state parameter is to prevent Cross-Site-Request-Forgery attacks. As such, it should be unique per user and should be connected to...

CVE-2023-28065

creationtimestamp| type| source ---|---|--- 2023-06-23 16:46:49+00:00| seen| https://t.me/cibsecurity/65457...

Authentication flaw

Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app...

Setting Strong and Unique Passwords: The First Line of Defense for PS5 Security

By Owais Sultan A strong password for your PS5 enhances security, thwarting unauthorized access and protecting your personal information and gaming… This is a post from HackRead.com Read the original post: Setting Strong and Unique Passwords: The First Line of Defense for PS5 Security...

PUB-A-261492548

Bulletin has no description...

What Makes Bitcoin NFTs Different from Other NFTs?

By Owais Sultan Non-fungible tokens NFTs have been gaining traction in the cryptocurrency world. They are digital assets that represent unique… This is a post from HackRead.com Read the original post: What Makes Bitcoin NFTs Different from Other NFTs?...

PT-2023-22586 · Douphp · Douphp

Name of the Vulnerable Software and Affected Versions: DouPHP version 1.7 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the unique id parameter in "/admin/article.php". This enables attackers to...

Bypass of CSRF protection in the presence of predictable userInfo

Description The CSRF protection enforced by the @fastify/csrf-protection library in combination with @fastify/cookie can be bypassed from network and same-site attackers under certain conditions. @fastify/csrf-protection supports an optional userInfo parameter that binds the CSRF token to the use...

CVE-2023-29524

creationtimestamp| type| source ---|---|--- 2023-04-19 07:43:15+00:00| seen| https://t.me/cibsecurity/62432...

7 Rapid Questions: Lindsey Searle

Welcome back to 7 Rapid Questions, our blog series where we ask passionate leaders at Rapid7 to give us an inside look at what it’s like to work on their team, and how they’re creating an impact every day. In this installment, we talk to Lindsey Searle, Senior Manager, Customer Advisors on how he...

CVE-2023-23588

A vulnerability has been identified in SIMATIC IPC1047 All versions, SIMATIC IPC1047E All versions with maxView Storage Manager 4.09.00.25611 on Windows, SIMATIC IPC647D All versions, SIMATIC IPC647E All versions with maxView Storage Manager 4.09.00.25611 on Windows, SIMATIC IPC847D All versions,...