CVE-2024-56083

Versions of Cognition Devin prior to 2024-12-12 are vulnerable to unauthorized write access to code. This occurs if an attacker discovers the VSCode live share URL (e.g., https://vscode-randomly_generated_string.devinapps.com) associated with a specific "Use Devin's Machine" session. Such URLs mi...

CVE-2024-56083

Cognition Devin before 2024-12-12 provides write access to code by an attacker who discovers the https://vscode-randomlygeneratedstring.devinapps.com URL aka the VSCode live share URL for a specific "Use Devin's Machine" session. For example, this URL may be discovered if a customer posts a...

CVE-2024-56083: Out-of-bounds Read

Cognition Devin before 2024-12-12 provides write access to code by an attacker who discovers the https://vscode-randomlygeneratedstring.devinapps.com URL aka the VSCode live share URL for a specific "Use Devin's Machine" session. For example, this URL may be discovered if a customer posts a...

Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and...

CVE-2024-55633 Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and...

CVE-2024-55633 Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and...

CVE-2024-11991

Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a few locations. This vulnerability could potentially allow unauthorized read or write access to a Canister's memory. However, exploiting this bug requires the...

CVE-2023-48010: Insufficiently Protected Credentials

STMicroelectronics SPC58 is vulnerable to Missing Protection Mechanism for Alternate Hardware Interface. Code running as Supervisor on the SPC58 PowerPC microcontrollers may disable the System Memory Protection Unit and gain unabridged read/write access to protected assets...

CVE-2024-11025 SMA: SQL injection in Sunny Central UP

An authenticated attacker with low privileges may use a SQL Injection vulnerability in the affected products administration panel to gain read and write access to a specific log file of the device...

CVE-2024-11483

A vulnerability was found in the Ansible Automation Platform AAP. This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansiblebase.oauth2provider for OAuth2 authentication. While th...

CVE-2024-11483 Automation-gateway: aap-gateway: improper scope handling in oauth2 tokens for aap 2.5

A vulnerability was found in the Ansible Automation Platform AAP. This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansiblebase.oauth2provider for OAuth2 authentication. While th...

The vulnerability in the usb_device.cgi script of NETGEAR’s router microprogramming software allows a hacker to induce a service failure.

The vulnerability in the usbdevice.cgi script of NETGEAR’s R8500 and R7000P router microprogramming systems lies in a buffer overflow that occurs during the processing of the cifsuser, readaccess, and writeaccess parameters. Exploiting this vulnerability allows an attacker to trigger a...

CVE-2020-26066 Cisco SD-WAN vManage Software XML External Entity Vulnerability

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity XXE entries when parsing certain XML...

CVE-2020-26066 Cisco SD-WAN vManage Software XML External Entity Vulnerability

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity XXE entries when parsing certain XML...

CVE-2020-25720

A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator...

CVE-2021-1483

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. This vulnerability is due to improper handling of XML External Entity XXE entries when the affected...

CVE-2021-1483: Improper Restriction of XML External Entity Reference

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. This vulnerability is due to improper handling of XML External Entity XXE entries when the affected...

Files or Directories Accessible to External Parties

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties by abusing the mail notification template via the dataUrl function. Note: This is only exploitable when the attacker have write permissions...

HPESBUX04729 rev.1 - HP-UX NTP Software, Denial of Service (DoS)

Potential Security Impact: Remote: Denial of Service DoS, Unauthorized Write Access to the File System, Null pointer dereference SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP-UX NTP Software - Prior to C.4.2.8.7.0 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- |...

buildah: Buildah allows arbitrary directory mount

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a RUN instruction in a Container file to mount an arbitrary directory from the host read/write into the container as long as those files can...