80 matches found
UBUNTU-CVE-2023-36617
A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396parser.rb and rfc3986parser.rb. NOTE: this issue exists becuse of a...
PT-2023-12189 · Cockpit · Cockpit
Name of the Vulnerable Software and Affected Versions: Cockpit versions 0.12.2 and prior Description: Cockpit is a content management system that allows addition of content management functionality to any site. In the affected versions, bad HTML sanitization in htmleditor.js may lead to cross-sit...
GHSA-G6HG-4V3C-6JQ7 Apache IoTDB subject to ReDOS with Java 8
Apache IoTDB versions 0.12.2 through 0.12.6, and 0.13.0 through 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. This issue is patched in 0.13.3. Users should upgrade or use a later version of Java to avoid it...
GHSA-5PQX-77VF-85RW Wikimedia Parsoid vulnerable to Cross-site Scripting (XSS)
An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a tag, bypassing sanitization steps, and potentially allowing for XSS...
[SECURITY] Fedora 34 Update: zola-0.12.2-10.fc34
Fast static site generator with everything built-in...
Prototype Pollution
Overview appwrite/server-ce is an End to end backend server for frontend and mobile apps. Affected versions of this package are vulnerable to Prototype Pollution. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leadi...
Minio 访问控制错误漏洞
Minio MinIO is an open source object storage server from the US-based MinIO Minio. The product supports building infrastructures for machine learning, analytics, and application data workloads. An access control error vulnerability exists in Minio 0.12.2 and prior versions, which stems from an...
DEBIAN-CVE-2021-30458
An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a tag, bypassing sanitization steps, and potentially allowing for XSS...
Google Http package For Dart Cross-Site Request Forgery Vulnerability
Google Http package For Dart is a U.S. Google Inc. for the Dart programming language Http support code base . A cross-site request forgery vulnerability exists in Google Http package For Dart version 0.12.2 and earlier versions, which allows an attacker to implement a CRLF injection into an HTTP...
Google Http package For Dart 注入漏洞
Google Http package For Dart is a U.S. Google Inc. for the Dart programming language Http support code base . A cross-site request forgery vulnerability exists in Google Http package For Dart version 0.12.2 and earlier versions, which allows an attacker to implement a CRLF injection into an HTTP...
PYSEC-2020-68
OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated in jupyterhub 1.2 configuration Authenticator.whitelist, which should be transparently mapped to Authenticator.allowedusers with a warning, is instead ignored by...
CVE-2020-26250 Base class whitelist configuration ignored in OAuthenticator
OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated in jupyterhub 1.2 configuration Authenticator.whitelist, which should be transparently mapped to Authenticator.allowedusers with a warning, is instead ignored by...
PYSEC-2019-134
The validators package 0.12.2 through 0.12.5 for Python enters an infinite loop when validators.domain is called with a crafted domain string. This is fixed in 0.12.6...
PYSEC-2019-64
The validators package 0.12.2 through 0.12.5 for Python enters an infinite loop when validators.domain is called with a crafted domain string. This is fixed in 0.12.6...
CVE-2013-6496
CVE-2013-6496 affects Red Hat Conga 0.12.2, enabling a remote attacker to cause information disclosure by issuing a crafted request to the Luci extension endpoints: (1) homebase, (2) cluster, (3) storage, (4) portal_skins/custom, or (5) logs. The linked sources corroborate this as the vulnerabili...
PT-2014-3142 · Red Hat · Red Hat Conga +2
Name of the Vulnerable Software and Affected Versions: Red Hat Conga version 0.12.2 Description: The issue allows remote attackers to obtain sensitive information via a crafted request to specific Luci extensions, including homebase, cluster, storage, portal skins/custom, or logs. Recommendations...
PT-2014-5371 · Red Hat · Red Hat Conga +1
Name of the Vulnerable Software and Affected Versions: Red Hat Conga version 0.12.2 Description: The issue allows remote authenticated users to bypass intended access restrictions. This is achieved via a crafted URL in the /luci/homebase and /luci/cluster menu components. Recommendations: For Red...
conga security, bug fix, and enhancement update
0.12.2-64.0.2.el5 - Remove conga-enterprise.patch 0.12.2-64.0.1.el5 - Added conga-enterprise.patch - Added conga-enterprise-Carthage.patch to support OEL5 - Replaced redhat logo image in conga-0.12.2.tar.gz and Data.fs 0.12.2-64 - Improvements for bz786372 Better protect luci's authentication...
weborf 0.12.2 - Directory Traversal
weborf 0.12.2 - Directory Traversal Title: Weborf httpd = 0.12.2 Directory Traversal Vulnerability Date: Sep 6, 2010 Author: Rew Link: http://galileo.dmi.unict.it/wiki/weborf/doku.php Version: 0.12.2 Tested On: Debian 5 CVE: N/A ============================================================= Weborf...
