GHSA-Q656-G2X3-8CGH Kylin can receive user input and load any class through Class.forName(...).

Kylin can receive user input and load any class through Class.forName.... This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions...

Codex Exposed: Exploring the Capabilities and Risks of OpenAI’s Code Generator

The first of a series of blog posts examines the security risks of Codex, a code generator powered by the GPT-3 engine...

CVE-2021-45458

Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlaceholderConfigurer to encrypt their passwor...

CVE-2021-27738

All request mappings in StreamingCoordinatorController.java handling /kylin/api/streamingcoordinator/ REST API endpoints did not include any security checks, which allowed an unauthenticated user to issue arbitrary requests, such as assigning/unassigning of streaming cubes, creation/modification...

Design/Logic Flaw

Kylin can receive user input and load any class through Class.forName.... This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions...

Security Bulletin: IBM Cloud Pak for Multicloud Management has applied security fixes for its use of Log4j for CVE-2021-44228

Summary IBM Cloud Pak for Multicloud Management has applied security fixes for its use of Log4j for CVE-2021-44228. Log4j is used by various microservices either directly or indirectly through dependent open source software for logging messages to files. Vulnerability Details CVEID: CVE-2021-4422...

Siemens S7 Layer 2 - Denial of Service (DoS)

Exploit Title: Siemens S7 Layer 2 - Denial of Service DoS Date: 21/10/2021 Exploit Author: RoseSecurity Vendor Homepage: https://www.siemens.com/us/en.html Version: Firmware versions = 3 Tested on: Siemens S7-300, S7-400 PLCs !/usr/bin/python3 from scapy.all import from colorama import Fore, Back...

umh.es Cross Site Scripting vulnerability OBB-2321889

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

jiajun-exhaust.com Cross Site Scripting vulnerability OBB-2321231

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2022-4819

Name of the Vulnerable Software and Affected Versions Blender versions 2.93.8 through 3.x Description The issue is related to a missing bounds check in the image loader, leading to out-of-bounds heap access. This allows an attacker to cause denial of service, memory corruption, or potentially cod...

openSUSE 15 Security Update : MozillaThunderbird (openSUSE-SU-2021:1635-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1635-1 advisory. - An issue present in lowering/register allocation could have led to obscure but deterministic register confusion failures in JITted code...

Exploit for SQL Injection in Cmsmadesimple Cms_Made_Simple

CVE-2019-9053 CVE-2019-9053 Exploit for Python 3 Last tested...

SUSE SLED15: MozillaThunderbird / MozillaThunderbird-translations-common / etc (SUSE-SU-2021:4150-1)

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:4150-1 advisory. - Update to version 91.4 MFSA 2021-54 bsc1193485 - CVE-2021-43536: URL leakage when navigating while executing asynchronous function -...

SUSE SLES15: libpython3_6m1_0 / python3 / python3-base / python3-curses / etc (SUSE-SU-2021:4015-2)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:4015-2 advisory. - CVE-2021-3737: Fixed http client infinite line reading DoS after a http 100. bsc1189241 - CVE-2021-3733: Fixed ReDoS in...

CVE-2021-45100

An unexpected, non-encrypted communication flaw in the Linux kernel's ksmbd Samba 3 protocol implementation subsystem was found in the way when user set flag SMB2GLOBALCAPENCRYPTION using the SMB 3.1.1 protocol. If during connection flag SMB2GLOBALCAPENCRYPTION being used by remote user, then for...

OpenEMR < 6.0.0 Patch 3 SQLi Vulnerability

OpenEMR is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:open-emr:openemr";...

Security update for MozillaThunderbird (important)

openSUSE Security Update: Security update for MozillaThunderbird Announcement ID: openSUSE-SU-2021:4150-1 Rating: important References: 1182863 1189547 1190244 1190269 1191332 1192250 1193485 Cross-References: CVE-2021-29981 CVE-2021-29982 CVE-2021-29987 CVE-2021-29991 CVE-2021-32810 CVE-2021-384...

Command injection

Mesa Labs AmegaView Versions 3.0 and prior has a command injection vulnerability that can be exploited to execute commands in the web server...

debian 安全漏洞

debian Debian GUN/Linux is a Linux operating system from the Debian Project. The system has faster and easier memory management, open source software support, good system security, and high stability. debian has a security vulnerability, which can lead to private key leaks. This issue is fixed in...

Debian DSA-5025-1 : tang - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dsa-5025 advisory. A flaw was discovered in tang, a network-based cryptographic binding server, which could result in leak of private keys. For the stable distribution bullseye, this problem...