ReDoS based DoS vulnerability in Active Support's underscore

There is a possible regular expression based DoS vulnerability in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-22796. Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 Rails LTS, which is a paid service and not part of the rubygem, 6.1.7.1,...

ReDoS based DoS vulnerability in Active Support’s underscore

There is a possible regular expression based DoS vulnerability in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-22796. Versions Affected: All Not affected: None Fixed Versions: 6.1.7.1, 7.0.4.1 Impact A specially crafted string passed to the underscore method ca...

PT-2022-27299 · Knime · Knime Analytics Platform

Name of the Vulnerable Software and Affected Versions: KNIME Analytics Platform versions 3.2.0 and above Description: A directory traversal vulnerability in the ZIP archive extraction routines can result in arbitrary files being overwritten on the user's system, also known as 'Zip-Slip'. An...

grafana-pcp security update

3.2.0-3 - bump NVR...

phpMyFAQ < 3.2.0 XSS Vulnerability

phpMyFAQ is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phpmyfaq:phpmyfaq"...

ai.catboost:catboost-spark_3.2_2.13 (>=1.0.6 <=1.2.10), ai.chronon:aggregator_2.13 (>=0.0.25 <=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91) +104 more potentially affected by CVE-2022-31777 via org.apache.spark:spark-core_2.13 (>=3.2.0 <=3.2.1)

org.apache.spark:spark-core2.13 MAVEN version =3.2.0, =1.0.6, =0.0.25, =0.0.25, =chaining-0.0.46-dev, =0.0.86, =0.0.14, =1.1.3, =1.4.0, =1.4.0, =0.2.3, =3.2.00.16.0, =0.14.0, =0.3.8-spark-3.1.2, =0.3.8-spark-3.2.0, =1.2.0-spark-3.2.0 - com.github.benfradet:spark-kafka-writer2.13 =0.6.0 and more...

GHSA-VRV9-3X3W-FFXW node-red-dashboard vulnerable to Cross-site Scripting

node-red-dashboard contains a cross-site scripting vulnerability. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component uitext Format Handler. The attack may be initiated remotely. The issue is patched in version 3.2.0...

node-red-dashboard vulnerable to Cross-site Scripting

node-red-dashboard contains a cross-site scripting vulnerability. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component uitext Format Handler. The attack may be initiated remotely. The issue is patched in version 3.2.0...

PT-2022-24104 · Node Red · Node-Red-Dashboard

Name of the Vulnerable Software and Affected Versions: node-red-dashboard versions prior to 3.2.0 Description: A cross-site scripting issue has been found in the node-red-dashboard, affecting the ui text Format Handler component, specifically in the file...

GHSA-6RJ8-9CM9-6GFF phpMyFAQ vulnerable to Cross-site Scripting

phpMyFAQ versions 3.1.7 and prior are vulnerable to stored cross-site scripting XSS. A patch is available on the main branch of the repository and anticipated to be part of version 3.2.0-alpha...

phpMyFAQ vulnerable to Cross-site Scripting

phpMyFAQ versions 3.1.7 and prior are vulnerable to stored cross-site scripting XSS. A patch is available on the main branch of the repository and anticipated to be part of version 3.2.0-alpha...

CVE-2022-3608 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-alpha...

PT-2022-23168 · Phpmyfaq · Phpmyfaq

Name of the Vulnerable Software and Affected Versions: phpMyFAQ versions prior to 3.2.0-alpha Description: The issue is related to stored Cross-site Scripting XSS in the phpMyFAQ repository. A patch for this issue is available on the main branch of the repository and is expected to be included in...

annalist (=0.5.18), anoteai (>=0.10.0 <=0.20.0) +96 more potentially affected by CVE-2022-36087 via oauthlib (>=3.1.1 <=3.2.0)

oauthlib PYPI version =3.1.1, =0.10.0, =1.1.89, =0.2.1, =0.7.11, =0.2.11, =1.0.0, =1.1.71, =1.2.0, =0.3.7, =1.0.28, =0.0.5, =0.0.33, =0.1.0, =0.0.1, =0.0.30 and more Source cves: CVE-2022-36087 Source advisory: OSV:PYSEC-2022-269...

ModSecurity SQL注入漏洞

ModSecurity is an intrusion detection and blocking engine that can be run as a module of the Apache web server or as a standalone application to enhance the security of web applications and protect them from known and unknown attacks. A SQL injection vulnerability exists in ModSecurity...

Apache Spark UI can allow impersonation if ACLs enabled

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to...

PYSEC-2022-236

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to...

PT-2022-3726

Name of the Vulnerable Software and Affected Versions Apache Spark versions 3.0.3 and earlier Apache Spark versions 3.1.1 to 3.1.2 Apache Spark versions 3.2.0 to 3.2.1 Description The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an...

CVE-2022-33891 Apache Spark shell command injection vulnerability via Spark UI

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to...

Northern.tech Mender 安全漏洞

Northern.tech Mender Enterprise is a wireless update manager for IoT devices from Northern.tech. A security vulnerability exists in Northern.tech Mender versions 3.2.0, 3.2.1, and 3.2.2, which stems from having incorrect access control, where any client on the same network can connect to this TCP...