76 matches found
PYSEC-2024-157
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. Applications that use the...
PT-2024-31429 · Ibm · Aspera Faspex
Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex versions 5.0.0 through 5.0.9 Description: The issue allows a user to bypass intended access restrictions and conduct resource modification. This flaw enables users to access and modify resources that they should not have...
PT-2024-14302
Name of the Vulnerable Software and Affected Versions StackIdeas EasyDiscuss versions 5.0.5 through 5.0.9 Description A SQL injection issue allows a remote attacker to obtain sensitive information via a crafted request to the search parameter in the Users module. Recommendations For versions 5.0....
OroCommerce Access Control Error Vulnerability
OroCommerce is an open source business-to-business commerce application from Oro. OroCommerce suffers from an Access Control Error vulnerability that stems from insufficient security checks, which allows an attacker to bypass Access Control Lists ACLs. Affected products and versions: OroCommerce...
Over 100,000 WordPress Websites Affected by XSS and SQLi Vulnerabilities in Slimstat Analytics Plugin
On August 24, 2023, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for a stored Cross-Site Scripting XSS and a Blind SQL Injection vulnerability in the Slimstat Analytics plugin, which is actively installed on more than 100,000 WordPress websites. T...
CVE-2023-26298
Previous versions of HP Device Manager prior to HPDM 5.0.10 could potentially allow command injection and/or elevation of privileges...
Command injection
Previous versions of HP Device Manager prior to HPDM 5.0.10 could potentially allow command injection and/or elevation of privileges...
PT-2023-20593 · Hewlett Packard · Hp Device Manager
Name of the Vulnerable Software and Affected Versions: HP Device Manager versions prior to 5.0.10 Description: The issue potentially allows command injection and/or elevation of privileges. Recommendations: For versions prior to 5.0.10, update to version 5.0.10 or later to resolve the issue...
PT-2023-20594 · Hewlett Packard · Hp Device Manager
Name of the Vulnerable Software and Affected Versions: HP Device Manager versions prior to 5.0.10 Description: The issue potentially allows command injection and/or elevation of privileges. Recommendations: For versions prior to 5.0.10, update to version 5.0.10 or later to resolve the issue...
PT-2023-20595 · Hewlett Packard · Hp Device Manager
Name of the Vulnerable Software and Affected Versions: HP Device Manager versions prior to 5.0.10 Description: The issue potentially allows command injection and/or elevation of privileges. Recommendations: For versions prior to 5.0.10, update to version 5.0.10 or later to resolve the issue...
PT-2023-20591 · Hewlett Packard · Hp Device Manager
Name of the Vulnerable Software and Affected Versions: HP Device Manager versions prior to 5.0.10 Description: The issue could potentially allow command injection and/or elevation of privileges. Recommendations: For versions prior to 5.0.10, update to version 5.0.10 or later to resolve the issue...
Security Bulletin: Publicly disclosed vulnerability in GNU Binutils affects IBM Netezza Platform Software
Summary GNU Binutils is used by IBM Netezza Platform Software. IBM Netezza Platform Software has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2021-3549 DESCRIPTION: GNU Binutils is vulnerable to a denial of service, caused by an out-of-bounds flaw in the objdump utility. By...
CVE-2021-37713
The npm package "tar" aka node-tar before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, ...
CVE-2021-37713
The npm package "tar" aka node-tar before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, ...
CVE-2021-37713
The npm package "tar" aka node-tar before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, ...
node-tar 路径遍历漏洞
node-tar is a package for file compression/decompression. A path traversal vulnerability exists in node-tar, which stems from an arbitrary file creation override and arbitrary code execution vulnerability in the npm package "tar" aka node-tar before 4.4.18, 5.0.10, and 6.1.9. An attacker could us...
PT-2021-7037 · Npm +6 · Node-Tar +6
Name of the Vulnerable Software and Affected Versions: node-tar versions prior to 4.4.18 node-tar versions prior to 5.0.10 node-tar versions prior to 6.1.9 Description: The issue is related to the handling of tar archives by the node-tar module, which can lead to arbitrary file creation, overwrit...
X-Cart 5.0.10 < 5.2.18 Open Redirect
According to the self-reported version in its response header, the version of X-Cart hosted on the remote web server is 5.0.10 5.2.18. It is, therefore, affected by a vulnerability in the redirect functionality. Note that the scanner has not tested for these issues but has instead relied only on...
UBUNTU-CVE-2021-3470
A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or process crash. Effectively this flaw does not affect the vast majority of users, who use...
WordPress 5.0.x < 5.0.10 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability exist in the block editor. - A cross-site scripting XSS vulnerability exist in media files. - An open redirect vulnerability exist...