Show filters
218 topics marked with the following tags:
Displaying 1-10 of 218
Sort by:
Attacker Value
Unknown
CVE-2024-21423
Disclosure Date: February 23, 2024 (last updated January 12, 2025)
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
2
Attacker Value
Moderate
CVE-2021-21255
Disclosure Date: March 02, 2021 (last updated November 28, 2024)
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI version 9.5.3, it was possible to switch entities with IDOR from a logged in user. This is fixed in version 9.5.4.
1
Attacker Value
Very High
CVE-2020-9338
Disclosure Date: February 22, 2020 (last updated November 27, 2024)
SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field.
0
Attacker Value
Low
CVE-2020-9339
Disclosure Date: February 22, 2020 (last updated November 27, 2024)
SOPlanning 1.45 allows XSS via the Name or Comment to status.php.
0
Attacker Value
Very High
CVE-2020-4521
Disclosure Date: September 14, 2020 (last updated November 28, 2024)
IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization in Java. By sending specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 182396.
1
Attacker Value
Moderate
CVE-2021-21324
Disclosure Date: March 08, 2021 (last updated November 28, 2024)
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 there is an Insecure Direct Object Reference (IDOR) on "Solutions". This vulnerability gives an unauthorized user the ability to enumerate GLPI items names (including users logins) using the knowbase search form (requires authentication). To Reproduce: Perform a valid authentication at your GLPI instance, Browse the ticket list and select any open ticket, click on Solution form, then Search a solution form that will redirect you to the endpoint /"glpi/front/knowbaseitem.php?item_itemtype=Ticket&item_items_id=18&forcetab=Knowbase$1", and the item_itemtype=Ticket parameter present in the previous URL will point to the PHP alias of glpi_tickets table, so just replace it with "Users" to point to glpi_users table instead; in the same way, item_items_id=18 will point to the related column id, so changing it too you sh…
1
Attacker Value
Moderate
CVE-2022-43781
Disclosure Date: November 17, 2022 (last updated October 03, 2024)
There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.
1
Attacker Value
Very High
CVE-2016-0792
Disclosure Date: April 07, 2016 (last updated November 25, 2024)
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.
1
Attacker Value
Low
CVE-2020-15408
Disclosure Date: July 28, 2020 (last updated November 28, 2024)
An issue was discovered in Pulse Secure Pulse Connect Secure before 9.1R8. An authenticated attacker can access the admin page console via the end-user web interface because of a rewrite.
0
Attacker Value
Moderate
CVE-2020-5252
Disclosure Date: March 23, 2020 (last updated November 27, 2024)
The command-line "safety" package for Python has a potential security issue. There are two Python characteristics that allow malicious code to “poison-pill” command-line Safety package detection routines by disguising, or obfuscating, other malicious or non-secure packages. This vulnerability is considered to be of low severity because the attack makes use of an existing Python condition, not the Safety tool itself. This can happen if: You are running Safety in a Python environment that you don’t trust. You are running Safety from the same Python environment where you have your dependencies installed. Dependency packages are being installed arbitrarily or without proper verification. Users can mitigate this issue by doing any of the following: Perform a static analysis by installing Docker and running the Safety Docker image: $ docker run --rm -it pyupio/safety check -r requirements.txt Run Safety against a static dependencies list, such as the requirements.txt file, in a separate, cl…
0