304 matches found
CVE-2023-46138 JumpServer default admin user email leak password reset
JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specifications. Prior to version 3.8.0, the default email for initial user admin is [email protected], and users reset their passwords by sending an email. Currently, the domain mycompany.com h...
CVE-2023-40123
In updateActionViews of PipMenuView.java, there is a possible bypass of a multi user security boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
Security feature bypass
In updateActionViews of PipMenuView.java, there is a possible bypass of a multi user security boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2023-40123
In updateActionViews of PipMenuView.java, there is a possible bypass of a multi user security boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
Who's Experimenting with AI Tools in Your Organization?
With the record-setting growth of consumer-focused AI productivity tools like ChatGPT, artificial intelligence—formerly the realm of data science and engineering teams—has become a resource available to every employee. From a productivity perspective, that's fantastic. Unfortunately for IT and...
CVE-2023-45141 CSRF Token Validation Vulnerability in fiber
Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery CSRF vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the...
CVE-2023-21289
In multiple locations, there is a possible bypass of a multi user security boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2023-21289
In multiple locations, there is a possible bypass of a multi user security boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
PT-2023-18068 · Google · Android
Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: In multiple locations, there is a possible bypass of a multi-user security boundary due to a confused deputy. This could lead to local information disclosure with no additional execution...
CVE-2023-30610 AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending
aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The awssigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is...
Upgraded Q -> 2 from #13 [1680615156614]
Judge has assessed an item in Issue 13 as 2 risk. The relevant finding follows: Lines of code Vulnerability details Impact The MuteBond.deposit function allows the user to purchase a bond with LP tokens and receive MUTE tokens in return. The bondPrice increases linearly over time which I should...
CVE-2022-3277
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significa...
CVE-2023-26039 ZoneMinder vulnerable to OS Command injection in daemonControl() API
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an OS Command Injection via daemonControl in /web/api/app/Controller/HostController.php. Any authenticated user can...
CVE-2023-21720 Microsoft Edge (Chromium-based) Tampering Vulnerability
...
PT-2022-26250 · Unknown · Klik Socialmediawebsite
Name of the Vulnerable Software and Affected Versions: KLiK SocialMediaWebsite version 1.0.1 Description: The issue allows attackers to store XSS via the location Forum Subject input, potentially affecting user security. Recommendations: For KLiK SocialMediaWebsite version 1.0.1, consider...
Adobe Photoshop Buffer Overflow Vulnerability (CNVD-2022-66021)
Adobe Photoshop is an application developed and distributed by Adobe for image processing. Adobe Photoshop is vulnerable to a buffer overflow vulnerability that could lead to the execution of arbitrary code in the context of the current user. An attacker could exploit this vulnerability to execut...
CVE-2018-14520
An issue was discovered in Kirby 2.5.12. The application allows malicious HTTP requests to be sent in order to trick a user into adding web pages...
PT-2022-8036 · Kirby · Kirby
Name of the Vulnerable Software and Affected Versions: Kirby version 2.5.12 Description: The issue allows malicious HTTP requests to be sent, which can trick a user into adding web pages. Recommendations: For Kirby version 2.5.12, at the moment, there is no information about a newer version that...
Cast to uint192 is unsafe
Judge @GalloDaSballo has assessed the 3rd item in QA Report 197 as Medium risk. The relevant finding follows: … Cast to uint192 is unsafe, user trying to deposit more than 2^192 would recevie less deposits balance. depositspidmsg.sender.amount += uint192amount; --- The text was updated...