56 matches found
PT-2026-37092
Name of the Vulnerable Software and Affected Versions redis-server versions prior to 8.6.3 Description Redis is an in-memory data structure store. The RESTORE command fails to properly validate serialized values. An authenticated attacker with permissions to execute this command can provide a...
PT-2026-37086
Name of the Vulnerable Software and Affected Versions redis-server versions prior to 8.6.3 Description An authenticated attacker can exploit the master-replica synchronization mechanism in redis-server to trigger a use-after-free condition on replicas where the replica-read-only setting is disabl...
PT-2026-37085
Name of the Vulnerable Software and Affected Versions redis-server versions 7.2.0 through 8.6.3 Description An authenticated attacker can trigger a use-after-free condition in the unblock client flow when a blocked client is evicted. This occurs because the system does not properly handle an erro...
Use of a Broken or Risky Cryptographic Algorithm
Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm via the Google authentication. An attacker can gain unauthorized access to...
PT-2026-22056
Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.3 Parse Server versions prior to 9.1.1-alpha.4 Description Parse Server is susceptible to a security issue where an unauthenticated attacker can create a forged Google authentication token using alg: "none" t...
CVE-2023-39971 Extension - acymailing.com - XSS in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3
Improper Neutralization of Input During Web Page Generation vulnerability in AcyMailing Enterprise component for Joomla allows XSS. This issue affects AcyMailing Enterprise component for Joomla: 6.7.0-8.6.3...
CVE-2023-39971 Extension - acymailing.com - XSS in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3
Improper Neutralization of Input During Web Page Generation vulnerability in AcyMailing Enterprise component for Joomla allows XSS. This issue affects AcyMailing Enterprise component for Joomla: 6.7.0-8.6.3...
PT-2023-27183 · Joomla · Acymailing Enterprise
Name of the Vulnerable Software and Affected Versions: AcyMailing Enterprise component for Joomla versions 6.7.0 through 8.6.3 Description: The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting XSS. This enables potential attackers to...
Security Bulletin: Multiple Vulnerabilities in Apache Commons Compress affect WebSphere Application Server used by IBM Maximo Application Suite
Summary Multiple Vulnerabilities in Apache Commons Compress affect WebSphere Application Server used by IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2021-35517 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an out of memory error when...
Security Bulletin: urllib upgrade CVE-2021-33503, CVE-2021-28363
Summary The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy if an SSLContext isn't given via proxyconfig doesn't verify the hostname of the certificate. This means certificat...
Oracle Knowledge Denial of Service Vulnerability
Oracle Knowledge is the United States Oracle Oracle company's set of knowledge management solutions. Information Manager Console is one of the information management console components. A security vulnerability exists in the Information Manager Console component in Oracle Knowledge versions 8.6.0...
CVE-2020-2524
Vulnerability in the Oracle Knowledge product of Oracle Knowledge component: InQuira Search. Supported versions that are affected are 8.6.0-8.6.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge. Successful attacks of...
Security Bulletin: IBM Forms Experience Builder is susceptible to a cross site scripting vulnerability (CVE-2016-0370)
Summary IBM Forms Experience Builder is susceptible to building an application by an administrator that could expose a cross site scripting vulnerability. Vulnerability Details CVEID: CVE-2016-0370 DESCRIPTION: IBM Forms Experience Builder is susceptible to building an application by an...
PT-2018-18368 · Libvips +3 · Libvips +3
Name of the Vulnerable Software and Affected Versions: libvips versions prior to 8.6.3 Description: A NULL function pointer dereference issue was found in the vips region generate function, which can be exploited by remote attackers using a crafted image file. This issue arises due to a race...
CVE-2016-0370
Cross-site scripting XSS vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an application that was built with this product...
