12,429 results · Clear filters · Feed
-
Low 3.1
Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence
Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing the signature PNG and the generated acceptance PDF in Account\AcceptanceController::store(). On filesystem drivers that return false instead of throwing on a write failure…
-
Low 3.7
PocketMine-MP before 5.39.2 Item Duplication via Despawn State
PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and …
-
Low 3.3
CWE-532: Insertion of Sensitive Information into Log File
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit th…
-
Low 3.3
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains…
-
Low 3.3
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains…
-
Low 2.4
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains…
-
Low 3.3
KeePass 2.35 through 2.61.1 Memory Exhaustion via KDBX Header Field Size
KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file declaring excessive header field lengths to trigger allocation of gigabytes of me…
-
Low 3.3
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains…
-
Low 3.7
WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address…
-
Low 3.7
WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer'…
-
Low 2.1
Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive informatio…
-
Low 3.1
Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had comp…
-
Low 3.1
Information leak in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the rend…
-
Low 3.1
Information leak in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the…
-
Low 3.1
Incorrect authorization in GPU in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker who had comp…
-
Low 3.1
Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-ori…
-
Low 3.1
Information leak in WebMCP in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the re…
-
Low 3.4
Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had c…
-
Low 3.1
Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromise…
-
Low 3.1
Incorrect authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised t…
-
Low 3.1
Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the …
-
Low 3.4
Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised t…
-
Low 3.1
Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromis…
-
Low 3.1
Missing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the…
-
Low 3.1
Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer…
-
Low 3.1
Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised th…
-
Low 3.4
Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the…
-
Low 3.1
Race condition in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social …
-
Low 2.7
Out of bounds read in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to read…
-
Low 3.5
An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailb…
-
Low 3.1
An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. …
-
Low 3.5
An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated …
-
Low 3.3
Dpdk: dpdk: missing length validation before reading command_data in virtio-net control queue handler
A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash.
-
Low 3.5
Adobe Experience Manager | Improper Input Validation (CWE-20)
Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write acce…
-
Low 3.3
In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due to a missing bounds check. This could le…
-
Low 3.5
In get_eht_operation_channel_width of ieee802_11_common.c, there is a possible out of bounds read due to an incorrect b…
-
Low 3.3
In multiple locations, there is a possible improper data sanitization due to a logic error in the code. This could lead…
-
Low 3.3
In openFile of AppFuseBridge.java, there is a possible information disclosure due to a missing permission check. This c…
-
Low 3.3
In screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a con…
-
Low 3.3
In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This cou…