1865 matches found
CVE-2005-0157
The confirm add-on in SmartList 3.15 and earlier allows attackers to subscribe arbitrary e-mail addresses by using a valid cookie that specifies an address other than the address for which the cookie was assigned...
DRUPAL-CONTRIB-2025-062
This module enables you to allow users to include a second authentication method in addition to password authentication. The module doesn't sufficiently prevent TFA from being bypassed when using the REST login routes. A new requirements check has been added to the status report so other...
Session Fixation
rack-session is vulnerable to session Fixation. The vulnerability is due to improper session invalidation due to sessions being restorable if an attacker with a valid session cookie triggers a long-running request concurrent with a legitimate user logout, allowing continued unauthorized access...
kernel: platform/x86/intel/pmc: Fix pmc_core_iounmap to call iounmap for valid addresses
In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/pmc: Fix pmccoreiounmap to call iounmap for valid addresses Commit 50c6dbdfd16e "x86/ioremap: Improve iounmap address range checks" introduces a WARN when adrress ranges of iounmap are invalid. On Thinkpad P1 G...
PT-2025-20847 · Unknown · Polarion V2310 +1
Name of the Vulnerable Software and Affected Versions: Polarion V2310 All versions Polarion V2404 versions prior to V2404.2 Description: A vulnerability has been identified in the login implementation of the affected application, which contains an observable response discrepancy when validating...
Race Condition
Overview rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between the so-called middleware into a singl...
Race Condition
Overview rack-session is a session implementation for Rack. Affected versions of this package are vulnerable to Race Condition in Rack::Session::Pool middleware, which allows an attacker to restore and use a deleted session. The attacker must be in possession of a valid session cookie and the...
CVE-2025-20151
A vulnerability in the implementation of the Simple Network Management Protocol Version 3 SNMPv3 feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to poll an affected device using SNMP, even if the device is configured to deny SNMP traffic from ...
CVE-2023-53066 qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
In the Linux kernel, the following vulnerability has been resolved: qed/qedsriov: guard against NULL derefs from qediovgetvfinfo We have to make sure that the info returned by the helper is valid before using it. Found by Linux Verification Center linuxtesting.org with the SVACE static analysis...
CVE-2022-49790
In the Linux kernel, the following vulnerability has been resolved: Input: iforce - invert valid length check when fetching device IDs syzbot is reporting uninitialized value at iforceinitdevice 1, for commit 6ac0aec6b0a6 "Input: iforce - allow callers supply data buffer when fetching device IDs"...
CVE-2022-49790 Input: iforce - invert valid length check when fetching device IDs
In the Linux kernel, the following vulnerability has been resolved: Input: iforce - invert valid length check when fetching device IDs syzbot is reporting uninitialized value at iforceinitdevice 1, for commit 6ac0aec6b0a6 "Input: iforce - allow callers supply data buffer when fetching device IDs"...
IR Trends Q1 2025: Phishing soars as identity-based attacks persist
Phishing attacks spiked this quarter as threat actors leveraged this method of initial access in half of all engagements, a vast increase from previous quarters. Conversely, the use of valid accounts for initial access was rarely seen this quarter, despite being the top observed method in 2024,...
Exploit for Unrestricted Upload of File with Dangerous Type in Boxbilling
CVE-2022-3552 In order to exploit the vulnerability in BoxBli...
CVE-2021-47664
Due to improper authentication mechanism an unauthenticated remote attacker can enumerate valid usernames...
CVE-2025-27927
An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API...
CVE-2025-31941
An unauthenticated attacker can obtain a list of smart devices by knowing a valid username...
DEBIAN-CVE-2025-2291
Password can be used past expiry in PgBouncer due to authquery not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password...
UBUNTU-CVE-2025-2291
Password can be used past expiry in PgBouncer due to authquery not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password...
CVE-2025-20150 Cisco Nexus Dashboard Username Enumeration Vulnerability
A vulnerability in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to enumerate LDAP user accounts. This vulnerability is due to the improper handling of LDAP authentication requests. An attacker could exploit this vulnerability by sending authentication requests to an...