WALLIX Access Manager 安全漏洞

WALLIX Access Manager is an access manager from WALLIX France. It filters external access to critical resources by remote employees or third-party vendors, and is also the ideal command center for centralizing the auditing of all Fortress sessions. A security vulnerability exists in WALLIX Access...

Wireshark 4.0.x < 4.0.3 Multiple Vulnerabilities

The version of Wireshark installed on the remote Windows host is prior to 4.0.3. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.0.3 advisory. - Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service vi...

Security Bulletin: OpenSSL Vulnerability Affects Watson Speech Services

Summary A Redhat OpenSSL Vulnerability affecting Watson Speech Services has been fixed in the latest version of IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data 4.0.3 Vulnerability Details CVEID:CVE-2021-3712 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive...

Security Bulletin: Redhat glibc Vulnerability affects Watson Speech Services

Summary A Redhat glibc Vulnerability affecting Watson Speech Services has been fixed in the latest version of IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data 4.0.3 Vulnerability Details CVEID:CVE-2021-27645 DESCRIPTION: GNU glibc is vulnerable to a denial of service, caused by...

Fedora 36 : php-Smarty (2022-52154efd61)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-52154efd61 advisory. 3.1.47 - 2022-09-14 Security - Applied appropriate javascript and html escaping in mailto plugin to counter injection attacks 454 Fixed - Fixed use ...

PT-2022-27263 · Cybozu · Cybozu Remote Service

Name of the Vulnerable Software and Affected Versions: Cybozu Remote Service versions 4.0.0 through 4.0.3 Description: The issue allows a remote authenticated attacker to consume huge storage space, potentially resulting in a denial-of-service DoS condition due to uncontrolled resource consumptio...

Cybozu Remote Service 资源管理错误漏洞

Cybozu Remote Service is a remote service management software from Cybozu Japan. It is used to access the Cybozu internal system. A security vulnerability exists in Cybozu Remote Service versions 4.0.0 through 4.0.3, which is caused by uncontrolled resource consumption...

CVE-2022-34266

The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service application crash, a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset function within...

Server side request forgery (ssrf)

Best Practical RT for Incident Response RTIR before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool...

CVE-2022-25800

Best Practical RT for Incident Response RTIR before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool...

Ubuntu 18.04 LTS : Smarty vulnerabilities (USN-5348-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5348-1 advisory. David Gnedt and Thomas Konrad discovered that Smarty was incorrectly sanitizing the paths present in the templates. An attacker could possibly use this u...

Command Injection

Overview czproject/git-php is a Library for work with Git repository in PHP. Affected versions of this package are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReadable$url, array $refs = NULL function, both the url and refs parameters are passed to the...

DEBIAN-CVE-2021-21408

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch...

UBUNTU-CVE-2021-21408

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch...

PT-2022-9201 · Smarty +2 · Smarty +2

Name of the Vulnerable Software and Affected Versions: Smarty versions prior to 3.1.43 Smarty versions prior to 4.0.3 Description: Smarty is a template engine for PHP that facilitates the separation of presentation from application logic. Template authors could run restricted static php methods...

Smarty 输入验证错误漏洞

Smarty is Smarty is a template engine for PHP that facilitates the separation of representation HTML/CSS from application logic. A security vulnerability exists in Smarty that stems from Smarty is a template engine for PHP that facilitates the separation of representation HTML CSS from applicatio...

Nextcloud 代码问题漏洞

Nextcloud is an open source self-hosted file synchronization and sharing communication application platform from Nextcloud Germany. nextcloud Contacts application prior to version 4.0.3 suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side...

ownCloud < 4.0.3 XSS Vulnerability (oC-SA-2012-019)

ownCloud is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"...

Advisory ROSA-SA-2021-1896

Software: libtiff 4.0.3 OS: Cobalt 7.9 CVE-ID: CVE-2016-3620 CVE-Crit: HIGH CVE-DESC: The ZIPEncode function in tifzip.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c zip" parameter is used, allows remote attackers to cause a denial of service buffer overflow via a generated BMP...

Input validation

Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileges via /manager/files URI. An authenticated user to the service may exploit incomplete input validation on the /manager/files API to inject arbitrary code within the API service...