405,389 results · Feed
-
High 7.5
A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions…
-
High 8.1
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Server-side HTML/JavaScript injecti…
-
Medium 4.2
Libstdc++: overflow leaves streambuf in inconsistent state on i/o error.
A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data into the internal memory buffer. An attacker capable of inducing repeated write failures in an affected service can trigg…
-
High 7.1
Gst-plugins-bad: gst-plugins-bad: off-by-one write in mxf demuxer temporal offset table
A flaw was found in GStreamer's MXF demuxer. When an application processes a crafted MXF file, an off-by-one bounds check can allow a one-byte write past the logical end of a temporal offset array. This may corrupt memory and cause the application to crash. T…
-
Medium 6.5
Gst-plugins-bad: gst-plugins-bad: missing bounds checks in mpeg ps pes header parsing
A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG …
-
High 7.5
Gst-plugins-base: gst-plugins-base: missing bounds checks in rtcp sdes packet parsing
A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiv…
-
High 8.8
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Cisco IOS command injection via DHC…
-
Medium 5.3
Samsung mTower lacks access control for TA sessions, allowing a Normal World application to open TA sessions and invoke…
-
High 8.8
OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.…
-
High 7.2
Zoho Corporation ManageEngine DDI Central version below 6201 is vulnerable to SQL injection in HA replication username …
-
High 7.5
Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to an unauthenticated GSS-TSIG keytab …
-
High 8.0
Authenticated Command Injection
Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This vulnerability could allow cluster-scoped operators to inject specially …
-
Critical 9.4
Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token
Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/cli_session needs no auth…
-
Medium 5.3
Missing authorization in device and deployment group page events allows view-role members to change devices and deployment groups
Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. …
-
Low 2.3
Improper session invalidation keeps removed or demoted members' open pages and device consoles working at their old role
Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they …
-
High 8.6
Mass assignment of organization, product and deployment group IDs allows users to write into other organizations and receive their firmware
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any …
-
Medium 6.5
Gst-plugins-bad: gst-plugins-bad: bounds check errors in mxf vanc packet handling
A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancillary packets can cause…
-
Medium 6.6
Cockpit: cockpit-storaged: tang keyserver address from an untrusted luks header clevis token reaches curl's argument vector as an option
A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a "--" separator. An address beginning with "-" is parsed by curl as an option instead of a hostname, …
-
High 7.4
Improper authentication lets Google sign-in and confirmation links sign users in to accounts registered with their email address by someone else
Improper Authentication vulnerability in Google sign-in and email confirmation in nerves-hub nerves_hub_web allows an attacker who registers another person's email address to share that person's account once they sign in. NervesHub.Accounts.update_or_create_u…
-
High 7.1
Incorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its firmware
Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization's product via…
-
High 7.5
Gstreamer: gstreamer: use-after-free in gstreamer core buffer value deserialization
A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an invalid character, an error path frees a mapped buffer before unmapping it. Applications that parse untrusted caps or structure data can re…
-
Medium 4.3
sooperset mcp-atlassian io.py validate_safe_path path traversal
A vulnerability was identified in sooperset mcp-atlassian up to 0.24.0. This issue affects the function validate_safe_path of the file src/mcp_atlassian/utils/io.py. The manipulation of the argument path leads to path traversal. The attack may be initiated re…
-
High 7.8
PackageKit ZYpp rollback vulnerability
Untrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing privilege escalation.
-
High 7.5
DoS via password reset
An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can result in a total loss of availabilit since the password will be reseted.
-
Medium 6.9
A high privileged remote attacker can upload arbitrary files to a guessable location. This can result in a loss of avai…
-
High 8.7
The backups created by the application use a weak static password allowing an unauthenticated remote attacker to access…
-
Critical 9.3
XSS in backend
An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of…
-
Medium 5.3
Authentication bypass in com_check
An unauthenticated remote attacker can perform an authentication bypass on the com_check function, potentially triggering traffic on other systems and email alerts. This can result in some loss of availability due to higher system loads.
-
High 8.1
CSRF in backend
An unauthenticated remote attacker can perform a CSRF attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss o…
-
High 8.7
An unauthenticated remote attacker can perform a DoS in the backends backup creation function. This can result in a tot…
-
High 8.6
A high privileged remote attacker can perform a code injection in the backends backup restore function leading to code …
-
High 7.2
OpenSSL command injection in ImportPKCS12
A high privileged remote attacker can perform an OpenSSL code injection in the backends ImportPKCS12 function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
-
High 7.2
OpenSSL command injection in device importer
A high privileged remote attacker can perform an OpenSSL code injection in the frontends device importer function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
-
High 7.2
Command injection in patch activate
A high privileged remote attacker can perform a code injection in the backends patch activate function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
-
High 8.6
A high privileged remote attacker can perform a code injection in the backends network auth function leading to code ex…
-
Medium 5.3
FraudLabs Pro SMS Verification <= 1.12.1 - Unauthenticated Unrestricted SMS Sending via wp_sms_action_send
The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS-retry limit on the server side, allowing unauthenticated users to send an unlimited number of verification SMS messages to attacker-chosen phone numbers, exhausting th…
-
Medium 5.3
Cargo Shipping Location for WooCommerce 4.0.0 - 5.7.1 - Unauthenticated Order Status Manipulation
The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses, relying on an attacker-controllable value for authorization, allowing unauthenticated users …
-
High 7.5
Path Traversal in Agent Memory Module of SAP Cloud SDK for Python
The agent_memory module accepts a caller-supplied tenant parameter in create_client(tenant=...). Prior to version 0.50.0, the tenant parameter was not validated before being used to construct filesystem paths for secret resolution. A value containing path tra…
-
High 7.5
Information Disclosure vulnerability in SAP Cloud SDK for AI(JavaScript)
SAP Cloud SDK for AI (Node.js) could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions. An attacker with low privileges and access to application logs or for…
-
Medium 6.8
Keycloak-services: keycloak-services: client-level mandatory pkce bypass via login-actions entry point
A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and authorization logic for the identity provider. The issue occurs when a user initiates a login after visiting the password reset page, causing the syste…