Search: “permitting”

CVE-2026-77883: Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist

Apache Syncope's JEXL template engine permits one-hop navigation past the JexlContextBuilder name denylist, enabling administrator-driven information disclosure.

CVE-2026-77883 is a moderate-severity exposure of sensitive information through data queries in Apache Syncope's syncope-core-provisioning-api module. An administrator can bypass the JexlContextBuilder name denylist using one-hop JEXL navigation to reach sensitive data. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security·Sep 14, 15:47 UTC · 2d agoVulnerabilityCVE-2026-778831

[vim-security] Ex Command Injection in sign_jump() in Vim < v9.2.1090

Vim sign_jump() before v9.2.1090 permits Ex command injection via unescaped buffer names; low-severity patch disclosed by Christian Brabandt.

Christian Brabandt disclosed an Ex command injection vulnerability in Vim's sign_jump() function affecting versions before v9.2.1090, caused by improper neutralization of unescaped buffer names. The issue is rated Low severity and maps to CWE-88 (argument injection) and CWE-94 (code injection). A CVE has been requested but not yet assigned.

oss-security·Sep 12, 17:53 UTC · 4d agoVulnerability

Microsoft Apps for macOS Exposed to Library Injection Attacks

Infosecurity Magazine·Aug 19, 15:15 UTC · Aug 19, 2024VulnerabilityCVE-2024-42220CVE-2024-42004CVE-2024-39804+5 CVEs1

The UK Bans Default Passwords

Schneier on Security·May 15, 00:00 UTC · May 15, 2024Vulnerability

Newly Declassified NSA Document on Cryptography in the 1970s

Schneier on Security·May 11, 14:09 UTC · May 11, 2021Vulnerability