801 matches found
PT-2021-20911
Name of the Vulnerable Software and Affected Versions: phpIPAM version 1.4.3 Description: The issue allows for Reflected XSS via the IP calculator, specifically through the app/dashboard/widgets/ipcalc-result.php and app/tools/ip-calculator/result.php endpoints. Recommendations: For phpIPAM versi...
CVE-2021-32652
Nextcloud Mail is a mail app for the Nextcloud platform. A missing permission check in Nextcloud Mail before 1.4.3 and 1.8.2 allows another authenticated users to access mail metadata of other users. Versions 1.4.3 and 1.8.2 contain patches for this vulnerability; no workarounds other than the...
Nextcloud 访问控制错误漏洞
Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. An access control error vulnerability exists in Nextcloud Mail versions prior to 1.4.3, and prior to 1.8.2, which can be exploited by an authenticated attacke...
PT-2021-19830 · Nextcloud · Nextcloud Mail
Name of the Vulnerable Software and Affected Versions: Nextcloud Mail versions prior to 1.4.3 Nextcloud Mail versions prior to 1.8.2 Description: A missing permission check in Nextcloud Mail allows another authenticated user to access mail metadata of other users. Recommendations: For versions...
Insecure Default
Overview Affected versions of this package are vulnerable to Insecure Default. In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions matching the input would only be set at completion time. Output files could therefore ...
GHSA-C8M9-MH38-97P9 XML external entity (XXE) vulnerability
An XML eXternal Entity XXE Injection was discovered in pmml-model before version 1.4.3. A remote attacker can exploit this vulnerability by sending a request to submit malicious External Entity references within the embedded XML metadata to the target system...
CVE-2020-24494
Insufficient access control in the firmware for the IntelR 722 Ethernet Controllers before version 1.4.3 may allow a privileged user to potentially enable denial of service via local access...
CVE-2020-24494
Insufficient access control in the firmware for the IntelR 722 Ethernet Controllers before version 1.4.3 may allow a privileged user to potentially enable denial of service via local access...
CVE-2020-24496
Insufficient input validation in the firmware for IntelR 722 Ethernet Controllers before version 1.4.3 may allow a privileged user to potentially enable denial of service via local access...
JetBrains Ktor HTTP Request Smuggling Vulnerability
Ktor is a framework for quickly creating web applications using the Kotlin language . An HTTP request smuggling vulnerability exists in JetBrains Ktor versions prior to 1.4.3. No detailed vulnerability details are provided at this time...
Design/Logic Flaw
In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible...
CVE-2021-25762
In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible...
Jetbrains JetBrains Ktor framework 环境问题漏洞
Ktor is a framework for quickly creating web applications using the Kotlin language . An HTTP request smuggling vulnerability exists in JetBrains Ktor versions prior to 1.4.3. No detailed vulnerability details are provided at this time...
CVE-2020-36190
The CVE-2020-36190 case affects the RailsAdmin (rails_admin) gem prior to 1.4.3 and 2.x prior to 2.0.2, exposing a cross-site scripting (XSS) vulnerability via nested forms. Root cause is unvalidated input in nested form handling, enabling injected scripts to be rendered in the browser. The impac...
RailsAdmin Cross-Site Scripting Vulnerability
RailsAdmin is a Rails engine from the Rails team that provides an easy-to-use interface to manage your data. A cross-site scripting vulnerability exists in RailsAdmin that can be exploited by an attacker to obtain sensitive information. The following products and versions are affected: RailsAdmin...
MGASA-2020-0471 Updated libmaxminddb packages fix security vulnerability
libmaxminddb before 1.4.3 has a heap-based buffer over-read in dumpentrydatalist in maxminddb.c CVE-2020-28241...
[ASA-202012-8] containerd: privilege escalation
Arch Linux Security Advisory ASA-202012-8 ========================================= Severity: High Date : 2020-12-05 CVE-ID : CVE-2020-15257 Package : containerd Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1309 Summary ======= The package containerd before...
CVE-2020-15257
containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that the connecting...
PT-2020-5862 · Containerd +5 · Kubernetes Containerd +4
Name of the Vulnerable Software and Affected Versions: containerd versions prior to 1.3.9 and 1.4.3 Description: The issue is related to the improper exposure of the containerd-shim API to host network containers. Access controls for the shim's API socket verified that the connecting process had ...