CVE-2022-41234

Jenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint, allowing users with Overall/Read permission to trigger jobs that are configured to be triggerable via Rundeck...

CVE-2022-41234: Missing Authorization

Jenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint, allowing users with Overall/Read permission to trigger jobs that are configured to be triggerable via Rundeck...

Missing webhook endpoint authorization in rundeck

rundeck 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint. This allows attackers with Item/Read permission to trigger jobs that are configured to be triggerable via Rundeck. As of publication of this advisory, there is no fix. Learn why we announce this...

CVE-2022-41238: Missing Authorization

A missing permission check in Jenkins DotCi Plugin 2.40.00 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository for attacker-specified commits...

The vulnerability of the QEMU hardware emulation software, related to the provision of unlimited memory, allows a hacker to trigger a service failure.

The vulnerability of the QEMU hardware emulation software is related to the allocation of unlimited memory. Exploiting this vulnerability allows a hacker to cause a system failure...

Should call triggerEndEpoch() or triggerDepeg() first before withdrawing in testOwnerAuthorize()

Lines of code Vulnerability details Detail In Tests section, sponsors said they would like to assess if testOwnerAuthorize are failed due to a logic fault in the contracts or in testing. In this test case, it wants to check if users can approve to other address to help them call withdraw on Vault...

GHSA-2M6G-CRV8-P3C6 Parse Server vulnerable to brute force guessing of user sensitive data via search patterns

Impact Internal fields keys used internally by Parse Server, prefixed by and protected fields user defined can be used as query constraints. Internal and protected fields are removed by Parse Server from query results and are only returned to the client using a valid master key. However, using...

Parse Server vulnerable to brute force guessing of user sensitive data via search patterns

Impact Internal fields keys used internally by Parse Server, prefixed by and protected fields user defined can be used as query constraints. Internal and protected fields are removed by Parse Server from query results and are only returned to the client using a valid master key. However, using...

The vulnerability of the Libvirt virtualization management library, related to insufficient blocking, allows a attacker to trigger a service failure.

The vulnerability of the Libvirt virtualization management library is related to insufficient blocking mechanisms. Exploiting this vulnerability could allow an attacker to cause a service failure...

AirDisk 7.5.5 Cross Site Scripting

Exploit Title: AirDisk 7.5.5 File Manager Stored XSS Date: Sep 8, 2022 Exploit Author: Chokri Hammedi Vendor Homepage: https://apps.apple.com/us/developer/felix-yew/id505904424 Software Link: https://apps.apple.com/us/app/airdisk-file-manager/id566530748 Version: 7.5.5 Tested on: iPhone ios 15.6 ...

CVE-2022-36079

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Internal fields keys used internally by Parse Server, prefixed by and protected fields user defined can be used as query constraints. Internal and protected fields are removed by Parse Server a...

Code injection

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Internal fields keys used internally by Parse Server, prefixed by and protected fields user defined can be used as query constraints. Internal and protected fields are removed by Parse Server a...

CVE-2022-36079 Parse Server vulnerable to brute force guessing of user sensitive data via search patterns

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Internal fields keys used internally by Parse Server, prefixed by and protected fields user defined can be used as query constraints. Internal and protected fields are removed by Parse Server a...

CVE-2022-36079 Parse Server vulnerable to brute force guessing of user sensitive data via search patterns

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Internal fields keys used internally by Parse Server, prefixed by and protected fields user defined can be used as query constraints. Internal and protected fields are removed by Parse Server a...

CVE-2022-36079

CVE-2022-36079 affects Parse Server. Internal/protected fields (prefixed with '_') can be used as query constraints, and before fixes users could enumerate these fields to elicit a response object. This vulnerability existed prior to patches in versions 4.10.14 and 5.2.5, which require the master...

PT-2022-23167 · Unknown · Parse Server

Name of the Vulnerable Software and Affected Versions: Parse Server versions prior to 4.10.14 Parse Server versions prior to 5.2.5 Description: Internal fields keys used internally by Parse Server, prefixed by and protected fields user defined can be used as query constraints. These fields are...

CVE-2022-38791

Removed by vendor...

CVE-2022-28883

A Denial-of-Service DoS vulnerability was discovered in F-Secure & WithSecure products whereby the aerdl unpack function crashes. This can lead to a possible scanning engine crash. The exploit can be triggered remotely by an attacker...

PT-2022-19287 · F Secure +1 · F-Secure +1

Name of the Vulnerable Software and Affected Versions: F-Secure & WithSecure products affected versions not specified Description: A Denial-of-Service DoS issue was discovered in F-Secure & WithSecure products. The aegen.dll goes into an infinite loop when unpacking PE files, leading to a scannin...

WithSecure Endpoint Protection 安全漏洞

WithSecure Endpoint Protection is a cloud-native, AI-powered endpoint protection from Finland's WithSecure. It can be deployed instantly from a browser and easily managed from a single console. WithSecure Endpoint Protection suffers from a security vulnerability that stems from the fact that...