626 matches found
CVE-2022-28653
Users can consume unlimited disk space in /var/crash...
sosreport sensitive information disclosure via weak permissions of the generated archives
sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive information by reading the contents of the archive...
Heroku Forces User Password Resets Following GitHub OAuth Token Theft
Salesforce-owned subsidiary Heroku on Thursday acknowledged that the theft of GitHub integration OAuth tokens further involved unauthorized access to an internal customer database. The company, in an updated notification, revealed that a compromised token was abused to breach the database and...
Masuit.Tools 安全漏洞
Masuit.Tools is a number of commonly used operation classes , mostly static classes , encryption and decryption , reflection operations , weighted random filtering algorithm , distributed short id , expression tree , linq extension , file compression , multi-threaded download and FTP client ,...
The vulnerability of the `add_post_var` function in the PHP programming language allows attackers to execute arbitrary PHP code.
The vulnerability of the addpostvar function in the PHP programming language is related to the use of memory after it is freed. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary PHP code...
The vulnerability of the ext/standard/var.c component of the PHP interpreter allows a attacker to cause a service failure.
The vulnerability of the ext/standard/var.c component of the PHP interpreter is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker to cause service failures remotely...
The vulnerability of the `ext/standard/var_unserializer.re` component in the PHP programming language allows a attacker to compromise data integrity.
The vulnerability of the ext/standard/varunserializer.re component in the PHP programming language lies in the use of memory after it is freed. Exploiting this vulnerability allows an attacker to compromise data integrity...
The vulnerability of the `ext/standard/var_unserializer.re` component in the PHP programming language allows a perpetrator to cause a service failure or potentially have other adverse effects.
The vulnerability of the ext/standard/varunserializer.re component in the PHP programming language arises due to buffer overflow. Exploiting this vulnerability can allow an attacker to cause service failures or potentially have other effects through unserialized calls that reference partially...
[SECURITY] Fedora 35 Update: varnish-modules-0.18.0-5.fc35
This is a collection of modules "vmods" extending Varnish VCL used for describing HTTP request/response policies with additional capabilities. This collection contains the following vmods: bodyaccess, header, saintmode, tcp, var, vsthrottle, xkey...
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that...
MariaDB 代码问题漏洞
MariaDB is a free and open source database management system from the MariaDB Foundation and a forked version of MySQL with the Maria storage engine. MariaDB suffers from a denial-of-service vulnerability that stems from the product allowing self-queries to be nested by nesting them within Update...
Arbitrary Code Execution
Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Arbitrary Code Execution via the ReceiveVarData function in the SocketClient.cs component. The socket client in the package can pass in the payload via the user-controllable input after it...
gcc-toolset-11-gcc security update
11.2.1-1.2.0.1 - Add -ftrivial-auto-var-init support from GCC12 Reviewed-by: Jose E. Marchesi - Add CTF/BTF support Reviewed-by: Qing Zhao 11.2.1-1.2 - add -Wbidirectional patch 2017819...
CVE-2021-34863
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the var:page parameter provided to the webpr...
GHSA-GQCF-83RQ-GPFR Any storage file can be downloaded from p.sh if full server path is known
The default configuration for platform.sh .platform.app.yaml allows access to uploaded files if you know or can guess their location, regardless of whether roles grant content read access to the content containing those files. If you're using Legacy Bridge, the default configuration also allows...
D-Link DAP-2020 安全漏洞
The D-Link DAP-2020 is a wireless N access point. A stack buffer overflow vulnerability exists in the D-Link DAP-2020, which is caused by incorrect boundary checking of the var:page parameter in the webproc endpoint. An attacker could exploit the vulnerability to cause a buffer overflow and execu...
CVE-2021-38623
The deferredimageprocessing aka Deferred image processing extension before 1.0.2 for TYPO3 allows Denial of Service via the FAL API because of /var/transient disk consumption...
CVE-2021-37345
Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because xi-sys.cfg is being imported from the var directory for some scripts with elevated permissions...
