PYSEC-2022-42987

CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts...

CLSA-2022-1668117586 Fix CVE(s): CVE-2019-2386

SECURITY UPDATE: After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones - debian/patches/CVE-2019-2386.patch: Validate...

CVE-2022-42905

creationtimestamp| type| source ---|---|--- 2022-11-07 02:33:44+00:00| seen| https://t.me/cibsecurity/52577 2023-01-17 10:37:08+00:00| seen| https://t.me/techb0ltGenona/3521 2024-01-26 18:07:14+00:00| seen| https://t.me/arpsyndicate/3026...

DEBIAN-CVE-2022-40284

A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code execution. A local attacker can exploit this if the ntfs-3g binary is setuid root. A physically proximate attacker can exploit this if NTFS-3G software is configured to execute upon...

The vulnerability of the Fortinet FortiNAC access control device lies in its lack of measures to protect the website structure, allowing attackers to execute cross-site scripting attacks.

The vulnerability of the Fortinet FortiNAC network access control device is related to the lack of protection for the website structure when processing the User ID parameter for the administrator. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...

PT-2022-26808 · Unknown · Canteen Management System

Name of the Vulnerable Software and Affected Versions: Canteen Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the userid parameter at the "/php action/fetchSelectedUser.php" API endpoint. Recommendations: F...

CVE-2022-40178

creationtimestamp| type| source ---|---|--- 2022-10-11 14:25:57+00:00| seen| https://t.me/cibsecurity/51107...

PT-2022-21134 · Zinc · Zinc

Name of the Vulnerable Software and Affected Versions: Zinc versions v0.1.9 through v0.3.1 Description: The issue is related to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript...

CVE-2022-40341

creationtimestamp| type| source ---|---|--- 2022-09-30 22:36:37+00:00| seen| https://t.me/cibsecurity/50806...

CVE-2022-28851

creationtimestamp| type| source ---|---|--- 2022-09-30 20:36:17+00:00| seen| https://t.me/cibsecurity/50778...

Bytebase allows low-privilege users to view admin projects

Overview The "Bytebase" application does not restrict low privilege user from accessing admin projects Details The "Bytebase" application does not restrict low privilege user from accessing admin projects for which an unauthorized user can view the "projects" created by "Admin". The affected...

IBM Rational Asset Manager 安全漏洞

IBM Rational Asset Manager is a collaborative software development tool from IBM, USA. Organizations can use it to identify, manage and govern the design, development and use of software assets and services. A privilege control issue vulnerability exists in IBM Rational Asset Manager version 7.5...

ieGeek IG20 安全特征问题漏洞

The ieGeek IG20 is a webcam from ieGeek. A security vulnerability exists in the ieGeek IG20 hipcam RealServer version V1.0, which stems from a predictability flaw in the algorithm that generates the device id uid as a result of its faulty access control, allowing a remote attacker to directly...

CVE-2022-35089

creationtimestamp| type| source ---|---|--- 2022-09-21 07:40:22+00:00| seen| https://t.me/cibsecurity/50169...

CVE-2022-39008

creationtimestamp| type| source ---|---|--- 2022-09-16 22:35:15+00:00| seen| https://t.me/cibsecurity/49971...

CVE-2022-38864

creationtimestamp| type| source ---|---|--- 2022-09-15 18:27:32+00:00| seen| https://t.me/cibsecurity/49814...

CVE-2022-37138

creationtimestamp| type| source ---|---|--- 2022-09-14 14:26:21+00:00| seen| https://t.me/cibsecurity/49757...

CVE-2022-20396

creationtimestamp| type| source ---|---|--- 2022-09-14 00:25:46+00:00| seen| https://t.me/cibsecurity/49724...

CVE-2022-31322

Penta Security Systems Inc WAPPLES v6.0 r3 4.10-hotfix1 allows attackers to escalate privileges via overwriting files using SUID flagged executables...

CVE-2021-3864

A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. The prerequisite is a SUID binary that sets real UID equal to effective UID, and real GID equal to effective GID. The descendant will then have a dumpable value set to 1. As a...