6218 matches found
Denial Of Service (DoS)
serialize-to-js is vulnerable to denial of service DoS. The vulnerability exists as the unvalidated user input could cause an infinite loop in the deserialize function...
Spoofing attack due to unvalidated KDC in node-krb5
Affected versions of node-krb5 do not validate the KDC prior to authenticating, which might allow an attacker with network access and enough time to spoof the KDC and impersonate a valid user without knowing their credentials. Recommendation It appears that this will remain unfixed indefinitely, ...
GHSA-4V9Q-HM2P-68C4 Spoofing attack due to unvalidated KDC in node-krb5
Affected versions of node-krb5 do not validate the KDC prior to authenticating, which might allow an attacker with network access and enough time to spoof the KDC and impersonate a valid user without knowing their credentials. Recommendation It appears that this will remain unfixed indefinitely, ...
Denial Of Service (DoS)
xorg-server is vulnerable to denial of service. The vulnerability exists as the handler for the XkbSetNames request does not validate the request length before accessing its contents, causing an integer underflow in the handler for the XIChangeHierarchy request through XkbSelectEvents...
Enhancesoft osTicket cross-site scripting vulnerability (CNVD-2020-49350)
Enhancesoft osTicket is a U.S. Enhancesoft's open source ticketing system. A cross-site scripting vulnerability exists in versions prior to Enhancesoft osTicket 1.14.3. The vulnerability is related to the affected version failing to properly validate client data. Because of an unvalidated echo $...
Exment Cross-Site Scripting Vulnerability
Exment is a Japanese free data management Web system with a simple structure, pre-existing business templates, and links to multiple types of data to minimize the trouble of searching. It supports windows, mac and linux systems. A cross-site scripting vulnerability exists in Exment v3.6.0 and pri...
CVE-2020-16193
osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info'notes' call...
Design/Logic Flaw
osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info'notes' call...
CVE-2020-16193
osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info'notes' call...
CVE-2020-15643
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...
CVE-2020-15640
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole 5.5.0.64. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getFileUploadBytes method of the FlashValidatorServiceImpl...
CVE-2020-17389
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...
CVE-2020-15639
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Authentication is not required to exploit this vulnerability. The specific flaw exists within the decryptFile method of the FlashValidatorServiceImpl class. The iss...
m.kentucky.universitypressscholarship.com Open Redirect vulnerability OBB-1270357
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
m.fordham.universitypressscholarship.com Open Redirect vulnerability OBB-1270359
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
minnesota.universitypressscholarship.com Open Redirect vulnerability OBB-1270321
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
oxfordwesternmusic.com Open Redirect vulnerability OBB-1270293
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
oxfordpoliticstrove.com Open Redirect vulnerability OBB-1270288
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
oxfordreference.com Open Redirect vulnerability OBB-1270273
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-10126
NCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly validate softare updates for the bunch note acceptor BNA, enabling an attacker with physical access to internal ATM components to restart the host computer and execute arbitrary code with SYSTEM privileges because while booting, the...