991 matches found
The vulnerability in the web client of IBM Datacap Navigator software for document collection and processing allows unauthorized individuals to access system data, enabling them to disclose protected information.
The vulnerability of the IBM Datacap Navigator software for document collection and processing lies in the fact that system data can be disclosed to unauthorized individuals. Exploiting this vulnerability allows a malicious actor to disclose protected information by sending specially crafted HTTP...
IBM Datacap Navigator Information Disclosure Vulnerability (CNVD-2024-33366)
IBM Datacap Navigator is a Web client for Datacap from International Business Machines IBM. An information disclosure vulnerability exists in IBM Datacap Navigator, which can be exploited by an attacker to obtain sensitive information when a detailed technical error message is returned in a brows...
IBM Datacap Navigator Cross-Site Scripting Vulnerability
IBM Datacap Navigator is a Web client for Datacap from International Business Machines IBM. A cross-site scripting vulnerability exists in IBM Datacap Navigator, which can be exploited by an attacker to embed arbitrary JavaScript code in the Web UI...
IBM Datacap Navigator 安全漏洞
IBM Datacap Navigator is a Web client for Datacap from International Business Machines IBM. A security vulnerability exists in IBM Datacap Navigator, which can be exploited by attackers to obtain sensitive information from the source code...
PT-2024-5324 · Ibm · Ibm Datacap Navigator
Name of the Vulnerable Software and Affected Versions: IBM Datacap Navigator versions 9.1.5 through 9.1.9 Description: The issue is related to the storage of critical information in plain clear text, which can be accessed by a local user. This could allow an attacker to gain unauthorized access t...
CVE-2024-39598
SAP CRM WebClient UI Framework allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the applicati...
CVE-2024-25639
Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's response and user inputs. This can trigger Cross Site Scripting XSS via Prompt Injection from untrusted documents either indexed by the user on Khoj or read by...
Malicious code in Tessa.Web.Client.Net (NuGet)
--- -= Per source details. Do not edit below this line.=-...
cloudevents/sdk-go: usage of WithRoundTripper to create a Client leaks credentials
A vulnerability was found in cloudevents/sdk-go. This issue involves using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper results in the go-sdk leaking credentials to arbitrary endpoints. When the transport is populated with an authenticated...
SFTPGo Security Vulnerabilities
SFTPGo is a full-featured and highly configurable SFTP server by Nicola Murino, a personal developer in Italy. A security vulnerability exists in SFTPGo versions v2.2.0 through v2.6.1, which stems from the SFTPGo WebAdmin and WebClient support for password reset, which, if enabled, allows even...
CVE-2024-34686
Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify...
PT-2024-25822 · Envoy · Envoy
Name of the Vulnerable Software and Affected Versions: Envoy affected versions not specified Description: The issue is related to an out-of-memory OOM vector exposed by Envoy, a cloud-native, open source edge and service proxy. This occurs because the async HTTP client buffers the response with a...
The vulnerability of the user interface of the SAP CRM WebClient UI, which allows an attacker to perform XSS attacks.
The vulnerability of the SAP CRM WebClient UI user interface lies in the lack of security measures taken to protect the web page structure. Exploiting this vulnerability allows an attacker to execute XSS attacks remotely...
io.vertx/vertx-core: memory leak due to the use of Netty FastThreadLocal data structures in Vertx
A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge,...
python-urllib3: Cookie request header isn't stripped during cross-origin redirects
A flaw was found in urllib3, a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, which is the responsibility of the user. However, it is possible for a user to specify a Cookie header and...
Mattermost crashes web clients via a malformed custom status
Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status...
CVE-2024-4182
Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status...
Mattermost 代码问题漏洞
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost that originates from an authenticated attacker being able to access the web client via a misformatted customized state. The vulnerability affects the...
