8500 matches found
GHSA-JMVV-524F-HJ5J Improper Handling of Exceptional Conditions in Apache Tomcat
The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the origin...
Lemur uses static IV per key
Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode...
GHSA-CHG9-3C3P-CH23 Lemur uses static IV per key
Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode...
Improper Limitation of a Pathname to a Restricted Directory in Spring Framework
Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling...
GHSA-HHM4-HWQ6-3C6W Improper Limitation of a Pathname to a Restricted Directory in Spring Framework
Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling...
PT-2022-37414
Name of the Vulnerable Software and Affected Versions static type map affected versions not specified Description The static type map crate will have no further releases. Users are advised to use the erased set crate instead. Recommendations At the moment, there is no information about a newer...
RHEL 8 : mod_auth_openidc:2.3 (RHSA-2022:1823)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1823 advisory. The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an Open...
xstream:XmlFuzzer: Uncaught exception in jaz.Zer.<clinit>
Project: https://github.com/x-stream/xstream.git Detailed Report: https://oss-fuzz.com/testcase?key=5154059834753024 Project: xstream Fuzzing Engine: libFuzzer Fuzz Target: XmlFuzzer Job Type: libfuzzerasanxstream Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State:...
Moderate: mod_auth_openidc:2.3 security update
The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: modauthopenidc: open redirect in oidcvalidateredirecturl CVE-2021-32786...
PT-2025-26017
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved. The issue is related to the csdlock debug kernel-boot parameter, which is parsed by the early param function csdlock debug. If set,...
Unbreakable Enterprise kernel-container security update
5.4.17-2136.307.3.1 - Revert 'rds/ib: recover rds connection from stuck tx path' Nagappan Ramasamy Palaniappan Orabug: 34124233 5.4.17-2136.307.3 - kvm: debugfs: fix memory leak in kvmcreatevmdebugfs Pavel Skripkin Orabug: 33099019 - KVM: debugfs: Reuse binary stats descriptors Jing Zhang Orabug:...
Icingaweb Directory Traversal in Static Library File Requests
Icingaweb versions from 2.9.0 to 2.9.5 inclusive, and 2.8.0 to 2.8.5 inclusive suffer from an unauthenticated directory traversal vulnerability. The vulnerability is triggered through the icinga-php-thirdparty library, which allows unauthenticated users to retrieve arbitrary files from the target...
CVE-2022-23724
Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an authentication flow to a target user. To exploit the vulnerability, must have compromised user credentials...
CVE-2022-23724
Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an authentication flow to a target user. To exploit the vulnerability, must have compromised user credentials...
Privilege Escalation
sinatra is vulnerable to Privilege Escalation. The vulnerability exists in static! function in base.rb because it doesn't validate expanded path matches publicdir when serving static files which allows an attacker to gain access to the system and perform unauthorized actions...
CVE-2022-23724 PingID Integration for Windows Login MFA Bypass
Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an authentication flow to a target user. To exploit the vulnerability, must have compromised user credentials...
PT-2022-16229 · Ping Identity · Pingid Integration For Windows Login
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves the use of static encryption key material, which allows for the forging of an authentication token to other users within a tenant...
Ping Identity Windows PingId 信任管理问题漏洞
Ping Identity Windows PingId is a software from Ping Identity, Inc. that provides security for applications. A vulnerability with trust management issues exists in PingId Integration for Windows Login 2.4.1 and prior versions, which stems from the use of static encryption key material to allow...