333 matches found
CVE-2021-42288 Windows Hello Security Feature Bypass Vulnerability
...
GHSA-8GWJ-8HXC-285W Prototype Pollution in json-ptr
This affects the package json-ptr before 3.0.0. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays...
CVE-2021-23440
This affects the package set-value before =3.0.0 4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays...
CVE-2021-23436
This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition p === "proto" || p === "constructor" in applyPatches...
Access Restriction Bypass
tomcat-catalina is vulnerable to access restriction bypass. Lack of proper sanitization of user provided parameter or configuration data provided by an administrator accept authentication using variations of their user name and/or to bypass some of the protection provided by the LockOut Realm...
Cisco ACI Multi-Site Orchestrator Application Services Engine Deployment Authentication Bypass (cisco-sa-mso-authbyp-bb5GmBQv)
According to its self-reported version, a vulnerability in an API endpoint of Cisco ACI Multi-Site Orchestrator MSO installed on the Application Services Engine could allow an unauthenticated, remote attacker to bypass authentication on an affected device. The vulnerability is due to improper tok...
Security Bulletin: A security vulnerability in Vault affects Bastion Service of IBM Cloud Pak for Multicloud Management
Summary A security vulnerability in Vault affects Bastion Service of IBM Cloud Pak for Multicloud Managemen 2.2.0 and previous version Vulnerability Details CVEID: CVE-2020-16250 DESCRIPTION: HashiCorp Vault and Vault Enterprise could allow a remote attacker to bypass security restrictions, cause...
Google Chrome navigations security bypass vulnerability
Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome navigations. An attacker can exploit this vulnerability to bypass security restrictions...
Google Chrome Security Bypass Vulnerability (CNVD-2021-14179)
Google Chrome is a web browser from Google, an American company. A security vulnerability exists in Google Chrome versions prior to 89.0.4389.72. An attacker can exploit this vulnerability to bypass security restrictions...
CVE-2021-24082
Microsoft.PowerShell.Utility Module WDAC Security Feature Bypass Vulnerability...
CVE-2021-22113
Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive Headers” restriction when executing requests with specially constructed URLs. Applications that use Spring Security's StrictHttpFirewall...
Important: thunderbird
Issue Overview: When drawing a transparent image on top of an unknown cross-origin image, the Skia library drawImage function took a variable amount of time depending on the content of the underlying image. This resulted in potential cross-origin information exposure of image content through timi...
CVE-2020-26160
jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with string for m"aud" which is allowed by the specification. Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lac...
Input validation
IBM Security Secret Server IBM Security Verify Privilege Vault Remote 1.2 could allow a local user to bypass security restrictions due to improper input validation. IBM X-Force ID: 184884...
Design/Logic Flaw
cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls SEC-541...
CVE-2019-18917
A potential security vulnerability has been identified for certain HP Printers and All-in-Ones that would allow bypassing account lockout...
CVE-2020-10196
CVE-2020-10196 affects the WordPress plugin Popup Builder (versions before 3.64.1). A stored XSS flaw exists in an unsecured AJAX action (com/classes/Ajax.php) where an unauthenticated attacker can POST to wp-admin/admin-ajax.php with action sgpb_autosave and an allPopupData payload (including th...
PT-2020-7565 · D Link · D-Link Dir-100
Name of the Vulnerable Software and Affected Versions: D-Link DIR-100 version 4.03B07 Description: The issue is related to a security bypass due to an error in the cliget.cgi script. Recommendations: For D-Link DIR-100 version 4.03B07, consider restricting access to the cliget.cgi script as a...
Unspecified Vulnerability in SecureWorks Red Cloak Windows Agent
SecureWorks Red Cloak Windows Agent is a security threat detection agent program for the Windows platform from SecureWorks USA. A security vulnerability exists in versions prior to SecureWorks Red Cloak Windows Agent 2.0.7.9. A local attacker can exploit this vulnerability to bypass security...