28503 matches found
GHSA-V358-RVXR-WFFX Silverstripe XSS Vulnerabilities
Multiple cross-site scripting XSS vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to inject arbitrary web script or HTML via 1. a crafted string to the AbsoluteLinks 1. BigSummary 1. ContextSummary 1. EscapeXML 1. FirstParagraph 1. FirstSentence 1...
MoinMoin Multiple vulnerable to directory traversal
Multiple directory traversal vulnerabilities in the 1 twikidraw action/twikidraw.py and 2 anywikidraw action/anywikidraw.py actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. NOTE: this can be leveraged wi...
edu.cmu.lti.oaqa.core.provider:solr-provider (1.0.3), org.apache.directmemory:directmemory-solr (0.1-incubating) +20 more potentially affected by CVE-2012-6612 via org.apache.solr:solr-core (3.6.0)
org.apache.solr:solr-core MAVEN version 3.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - edu.cmu.lti.oaqa.core.provider:solr-provider 1.0.3 - org.apache.directmemory:directmemory-solr 0.1-incubating...
ai.mattmann.mnemosyne:cas-crawler (1.11.0), ai.mattmann.mnemosyne:cas-filemgr (1.11.0) +26 more potentially affected by CVE-2012-6612 via org.apache.solr:solr-core (1.3.0)
org.apache.solr:solr-core MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - ai.mattmann.mnemosyne:cas-crawler 1.11.0 - ai.mattmann.mnemosyne:cas-filemgr 1.11.0 -...
com.chenlb.mmseg4j:mmseg4j-for-solr40 (1.0.0), com.chenlb.mmseg4j:mmseg4j-solr (1.9.0) +25 more potentially affected by CVE-2012-6612 via org.apache.solr:solr-core (>=4.0.0-alpha, <=4.0.0)
org.apache.solr:solr-core MAVEN version =4.0.0-alpha, =0.3.4, =1.0.3, =1.0.3, =1.0.3, =1.0.3, =0.1, =0.7, =0.7, =4.0.0-alpha, =4.0.0-alpha, =4.0.0 and more Source cves: CVE-2012-6612 Source advisory: GHSA-6CPJ-3G83-Q2J4...
com.github.jknack:mwa-solr3 (>=0.3.4, <=0.3.10), com.tobedevoured:solr_sail (0.0.2) +111 more potentially affected by CVE-2012-6612 via org.apache.solr:solr-core (3.6.1)
org.apache.solr:solr-core MAVEN version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - com.github.jknack:mwa-solr3 =0.3.4, =8.5.1.1, =1.0.4, =1.0.0, =1.0.1 - org.apache.solr:solr 3.6.1 -...
com.linkedin.zoie:zoie-solr (>=2.5.1, <=3.0.0), org.apache.solr:solr-clustering (1.4.0) +19 more potentially affected by CVE-2012-6612 via org.apache.solr:solr-core (1.4.0)
org.apache.solr:solr-core MAVEN version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.solr:solr-core and may be impacted: - com.linkedin.zoie:zoie-solr =2.5.1, =3.2.0.cr1, =3.2.0.cr1, =5.3, =5.3, =1.2.0-m2, =1.2.0-m2, =1.2.0-m2,...
GHSA-RP9P-863F-9C4H Cross-site Scripting in Apache ActiveMQ
Multiple cross-site scripting XSS vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via 1 the refresh parameter to PortfolioPublishServlet.java aka demo/portfolioPublish or Market Data Publisher, or vectors involving 2...
GHSA-G4JG-GPWV-P7WV Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy
The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding JAXB input, aka an XML external entity XXE injection attack, a similar vulnerability to...
GHSA-VWR9-9F8V-VP5M OpenStack Glance arbitrary deletion of non-protected images
The v2 API in OpenStack Glance Grizzly, Folsom 2012.2, and Essex 2012.1 allows remote authenticated users to delete arbitrary non-protected images via an image deletion request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4573...
GHSA-W66P-78G4-MR7G OpenStack Keystone Insufficient token expiration
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression...
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2012-2395 cobbler: command injection flaw in the power management XML-RPC API...
GHSA-QHXW-54M9-6WWC MitM on Jenkins Maven Plugin
Jenkins Maven Plugin 2.17 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. Maven Plugin 3.0 no longer has a dependency on commons-httpclient...
MitM on Jenkins Maven Plugin
Jenkins Maven Plugin 2.17 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. Maven Plugin 3.0 no longer has a dependency on commons-httpclient...
Puppet Denial of Service and Arbitrary File Write
A vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise PE Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to 1 cause a denial of service memory consumption via a REST request to a stream that triggers...
Several Zend Products Vulnerable to XXE and XEE attacks
Zend Framework 1 ZF1 before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendServiceAudioScrobbler, ZendServiceNirvanix, ZendServiceSlideShare, ZendServiceTechnorati, and ZendServiceWindowsAzure before 2.0.2, ZendServiceAmazon before 2.0.3, and ZendServiceAp...
Puppet Denial of Service and Arbitrary File Write
A vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise PE Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to 1 cause a denial of service memory consumption via a REST request to a stream that triggers...
May 10, 2022—KB5014018 (Security-only update)
None None...