1019 matches found
Magento 2 Community Edition Incorrect Authorization
Magento versions 2.4.0 and 2.3.5p1 and earlier are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under their old role after an administrator removes the role or disables the user's account...
Magento 2 Community Edition XSS Vulnerability
Magento versions 2.4.0 and 2.3.5p1 and earlier are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This...
AZL-9852 CVE-2022-29217 affecting package python-jwt for versions less than 2.4.0-1
PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can...
PYSEC-2022-202
PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can...
GHSA-CW56-J3FM-7W57 Regular expression denial of service in Apache ShenYu
In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matchesconditionData.getParamValue, realData to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource...
Code injection
In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matchesconditionData.getParamValue, realData to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource...
OpenStack Object Storage (Swift) allows remote attackers to cause a denial of service
OpenStack Object Storage Swift before 2.4.0 does not properly close client connections, which allows remote attackers to cause a denial of service proxy-server resource consumption via a series of interrupted requests to a Large Object URL...
Cross-site scripting in yui 2.4.0
Cross-site scripting XSS vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to charts.swf, a similar issue to CVE-2010-4207...
GHSA-JJG9-MF63-VQRP Cross-site scripting in yui 2.4.0
Cross-site scripting XSS vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to charts.swf, a similar issue to CVE-2010-4207...
GHSA-RPJM-422R-95MH Regular expression denial of service in apache tika
In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standa...
UBUNTU-CVE-2022-30126
In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standa...
CVE-2022-30126 Apache Tika Regular Expression Denial of Service in Standards Extractor
In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standa...
PT-2022-17108 · Apache +1 · Apache Tika +1
Name of the Vulnerable Software and Affected Versions: Apache Tika versions prior to 1.28.2 Apache Tika versions prior to 2.4.0 Description: The issue concerns the BPG parser in Apache Tika, which may allocate an excessive amount of memory when processing carefully crafted files. Recommendations:...
CVE-2022-30126
In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standa...
PT-2022-7130 · Pypi +4 · Pyjwt +4
Name of the Vulnerable Software and Affected Versions: PyJWT versions prior to 2.4.0 Description: The issue is related to the implementation of JWT in Python PyJWT, where an attacker can exploit the lack of restrictions on certain open key formats. This allows a remote attacker to impact the...
CVE-2021-38425
eProsima Fast DDS versions prior to 2.4.0 2269 are susceptible to exploitation when an attacker sends a specially crafted packet to flood a target device with unwanted traffic, which may result in a denial-of-service condition and information exposure...
PT-2022-10721 · Eprosima +2 · Eprosima Fast Dds +2
Name of the Vulnerable Software and Affected Versions: eProsima Fast DDS versions prior to 2.4.0 Description: The issue allows an attacker to send a specially crafted packet to flood a target device with unwanted traffic. This may result in a denial-of-service condition and information exposure...
Python DoS Vulnerability (bpo-44394) - Mac OS X
Python is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python";...
[SECURITY] Fedora 34 Update: openjpeg2-2.4.0-4.fc34
The OpenJPEG library is an open-source JPEG 2000 library developed in order to promote the use of JPEG 2000. This package contains JPEG 2000 codec compliant with the Part 1 of the standard Class-1 Profile-1 compliance. JP2 JPEG 2000 standard Part 2 - Handling of JP2 boxes and extended multiple...
