CWE-472

Aplikacja Hashview w wersji 0.8.1 umożliwia przejęcie dowolnego konta użytkownika poprzez manipulację nagłówkiem HTTP Host podczas procesu resetowania hasła. Podatność wynika z braku skonfigurowanej zmiennej SERVER_NAME, przez co link resetujący hasło jest budowany na podstawie niezaufanego nagłówka dostarczanego przez atakującego.

Aplikacja fblog w wersji do commitu 983bede umożliwia przejęcie dowolnego konta użytkownika poprzez funkcję resetowania hasła. Podatność wynika z braku konfiguracji zmiennej SERVER_NAME, co powoduje, że link do resetu hasła jest generowany na podstawie nagłówka HTTP Host dostarczonego przez atakującego.

Podatność path traversal w komponencie 'ftpservlet' portalu webowego Fortra FileCatalyst Workflow pozwala na przesyłanie plików poza wyznaczony katalog 'uploadtemp'. W przypadku skutecznego przesłania złośliwego pliku JSP do katalogu DocumentRoot możliwe jest zdalne wykonanie kodu (RCE), w tym instalacja web shella.

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as the root user on an affected device. These vulnerabilities exist because HTTP requests are not properly validated. An attacker could exploit these vulnerabilities by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to remotely execute arbitrary code on the device.

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as the root user on an affected device. These vulnerabilities exist because HTTP requests are not properly validated. An attacker could exploit these vulnerabilities by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to remotely execute arbitrary code on the device.

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as the root user on an affected device. These vulnerabilities exist because HTTP requests are not properly validated. An attacker could exploit these vulnerabilities by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to remotely execute arbitrary code on the device.

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as the root user on an affected device. These vulnerabilities exist because HTTP requests are not properly validated. An attacker could exploit these vulnerabilities by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to remotely execute arbitrary code on the device.

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as the root user on an affected device. These vulnerabilities exist because HTTP requests are not properly validated. An attacker could exploit these vulnerabilities by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to remotely execute arbitrary code on the device.

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as the root user on an affected device. These vulnerabilities exist because HTTP requests are not properly validated. An attacker could exploit these vulnerabilities by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to remotely execute arbitrary code on the device.

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as the root user on an affected device. These vulnerabilities exist because HTTP requests are not properly validated. An attacker could exploit these vulnerabilities by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to remotely execute arbitrary code on the device.

Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Podatność integer overflow w komponencie ANGLE przeglądarki Google Chrome (wersje przed 149.0.7827.53) pozwala atakującemu, który już skompromitował proces renderera, na ucieczkę z piaskownicy (sandbox escape). Ucieczka z sandbox jest szczególnie groźna, ponieważ może prowadzić do pełnego przejęcia kontroli nad systemem ofiary.

Podatność w Cerebrate przed wersją 1.30 umożliwia uwierzytelnionemu użytkownikowi bez uprawnień administracyjnych eskalację własnych uprawnień do wyższej roli (np. administratora). Jest to poważne zagrożenie, ponieważ atakujący z dostępem do zwykłego konta może przejąć pełną kontrolę nad systemem.

Podatność w mechanizmie odzyskiwania hasła w systemie Payload CMS pozwala nieuwierzytelnionemu atakującemu na wykonywanie działań w imieniu użytkownika, który zainicjował reset hasła. Ze względu na brak wymaganych uprawnień (CVSS AV:N/PR:N) oraz krytyczny poziom zagrożenia, podatność stanowi poważne ryzyko dla bezpieczeństwa kont użytkowników.

Integer overflow in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Integer overflow in Fonts in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Medium)

Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Integer overflow in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)