GitHub Security Lab: [Java] CWE-759: Query to detect password hash without a salt

This bug was reported directly to GitHub Security Lab...

de Consumentenbond Sannce Smart HD Baby Monitor 授权问题漏洞

The de Consumentenbond Sannce Smart HD Baby Monitor is a webcam from de Consumentenbond in the Netherlands. It provides monitoring functionality. A security vulnerability exists in the Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices, which can be exploited by an attacker to gain...

Acexy Wireless-N WiFi Repeater REV 安全漏洞

Amazon Acexy Wireless-N WiFi Repeater REV is an Amazon.com, Inc. It is used to provide network services A security vulnerability exists in Acexy Wireless-N WiFi Repeater REV 1.0 that originates from the ability to change the administrator password without authentication...

CVE-2021-25351

Improper Access Control in EmailValidationView in Samsung Account prior to version 10.7.0.7 and 12.1.1.3 allows physically proximate attackers to log out user account on device without user password...

Samsung EmailValidationView 安全漏洞

Samsung EmailValidationView is an application from Samsung Korea. Provides email functionality. A security vulnerability exists in Samsung EmailValidationView that stems from improper access control and can be exploited by an attacker to log out of a user account on a device without a user passwo...

UBUNTU-CVE-2021-23984

A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be fully controllable, but in this situation was. This could have been used to spoof a website and attempt to trick the user into providing credentials. This...

The vulnerability of the information protection system against unauthorized access in Dallas Lock, related to security errors, allows a malicious individual to print text files without saving information about the printing events.

The vulnerability of the Dallas Lock information protection system against unauthorized access is related to security-related errors. Exploiting this vulnerability allows a malicious actor to print text files without storing information about the printing events...

杰印资讯公司 Excellent Infotek Corporation EIC e-document system 授权问题漏洞

Excellent Infotek Corporation EIC e-document system is an application system of Excellent Infotek Corporation. EIC e-document system is an application system of Excellent Infotek Corporation. It provides precise, simple and standardized XML document forms to simplify the process of writing and...

GE Grid Solutions UR 信息泄露漏洞

GE Grid Solutions UR is an embedded operating system from GE Grid Solutions, France. It provides high-performance protection, scalable I/O, integrated monitoring and metering, high-speed communications, and extensive programming and configuration capabilities. An information disclosure...

PT-2021-14449 · Elementary Os · Switchboard Bluetooth Plug

Name of the Vulnerable Software and Affected Versions: Switchboard Bluetooth Plug for elementary OS versions 2.3.0 through 2.3.5 Description: The issue allows physically proximate attackers to pair with a device running an affected version of switchboard-plug-bluetooth without the active consent ...

CVE-2020-19419

Incorrect Access Control in Emerson Smart Wireless Gateway 1420 4.6.59 allows remote attackers to obtain sensitive device information from the administrator console without authentication...

RATCF 授权问题漏洞

RATCF is an open source framework for hosting Cyber-Security Capture the Flag events. RATCF suffers from an authorization issue vulnerability that originates from the fact that a user with multi-factor authentication enabled can log in without a valid token...

SUSE Linux Enterprise Server 授权问题漏洞

SUSE Linux Enterprise Server is a suite of enterprise server edition Linux operating systems from SUSE Germany. An authorization issue vulnerability exists in SUSE Linux Enterprise Server, which can be exploited by an attacker to execute arbitrary code via salt without specifying valid credential...

CVE-2021-22856

The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege...

CVE-2021-20067

Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to view sensitive syslog events without authentication...

CVE-2021-20067

Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to view sensitive syslog events without authentication...

infinispan: authorization check missing for server management operations

A flaw was found in the Infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role. The highest threat...

UBUNTU-CVE-2021-21436

Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7.0.x version 7.0.14 and prior versions...

CVE-2021-3336

DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate. The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3...

sudo: Heap buffer overflow in argument parsing

A flaw was found in sudo. A heap-based buffer overflow was found in the way sudo parses command line arguments. This flaw is exploitable by any local user who can execute the sudo command by default, any local user can execute sudo without authentication. Successful exploitation of this flaw coul...