CVE-2022-43409

Jenkins Pipeline: Supporting APIs Plugin 838.va3a087b4055b and earlier does not sanitize or properly encode URLs of hyperlinks sending POST requests in build logs, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to create Pipelines...

CVE-2022-21626

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Easily exploitable vulnerabili...

CVE-2022-21624

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JNDI. Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to exploit...

PT-2022-6167 · Go +3 · Go +3

Name of the Vulnerable Software and Affected Versions: Go versions prior to the fixed version Description: The issue is related to unsanitized NUL values in environment variables on Windows. Attackers may exploit this behavior to set arbitrary environment variables. In syscall.StartProcess and...

admin-tool-button (>=1.0.1a0 <=1.0.5a0), aimmo (>=2.0.0 <=2.5.8) +95 more potentially affected by CVE-2022-41323 via django (>=3.2.0 <=3.2.15)

django PYPI version =3.2.0, =1.0.1a0, =2.0.0, =6.2.0, =0.2.0, =22.0.0.dev21, =22.0.0.dev13, =22.0.0.dev29, =6.0.0, =6.0.0, =1.1.0, =1.1.3 - common-framework =2021.4.1 and more Source cves: CVE-2022-41323 Source advisory: OSV:GHSA-QRW5-5H28-6CMG...

JSON Web Token (JWT) Weaknesses

JSON Web Tokens, or JWTs, are an encoded set of claims commonly seen in REST APIs and Single page web applications SPAs. These encoded claims are used to provide identification of the requester and other information related to accessing. It is a stateless mechanism, and the token is sent with eve...

Business-central: Possible XML External Entity Injection attack

An XML external entity injectionXXE vulnerability was found in Business Central. This flaw allows an attacker to interfere with an application's processing of XML data. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. T...

Debian dla-3127 : libhttp-daemon-perl - security update

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3127 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3127-1 [email protected] https://www.debian.org/lts/security/...

The vulnerability of Mozilla Firefox, Mozilla Firefox ESR, and the email client Thunderbird arises from the improper use of privileged APIs, allowing an attacker to install extensions.

The vulnerability in Mozilla Firefox, Mozilla Firefox ESR, and the email client Thunderbird is related to the improper use of privileged APIs. Exploiting this vulnerability allows a malicious actor to install extensions by capturing the link to the eval function from the about:blank window, there...

GHSA-5J86-VMPX-42PC Liferay Portal Path Traversal Vulnerability via the Hypermedia REST APIs Module

Path traversal vulnerability in the Hypermedia REST APIs module before 4.0.12 from Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the parameter parameter...

Liferay Portal Path Traversal Vulnerability via the Hypermedia REST APIs Module

Path traversal vulnerability in the Hypermedia REST APIs module before 4.0.12 from Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the parameter parameter...

[SECURITY] Fedora 35 Update: ImageMagick-6.9.12.63-1.fc35

ImageMagick is an image display and manipulation tool for the X Window System. ImageMagick can read and write JPEG, TIFF, PNM, GIF, and Photo CD image formats. It can resize, rotate, sharpen, color reduce, or add special effects to an image, and when finished you can either save the completed wor...

CVE-2022-28981

Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the parameter parameter...

Path traversal

Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the parameter parameter...

CVE-2022-28981

Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the parameter parameter...

CVE-2022-28981

Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the parameter parameter...

CVE-2022-28981

CVE-2022-28981 is a path traversal vulnerability in the Hypermedia REST APIs module of Liferay Portal 7.4.0–7.4.2. The issue allows remote attackers to access files outside com.liferay.headless.discovery.web/META-INF/resources via the parameter parameter. Impact is file disclosure; CVSS v3.1 base...

CVE-2022-28981

Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the parameter parameter...

PT-2022-19341 · Liferay · Liferay Portal

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.2 Description: A path traversal issue in the Hypermedia REST APIs module allows remote attackers to access files outside of the intended directory via the parameter parameter. This could potentially...

abi-ds-utils (=1.0.1), airflow-add-ons (=0.2.9b1) +4 more potentially affected by CVE-2022-40604 via apache-airflow (>=2.3.2 <=2.4.0)

apache-airflow PYPI version =2.3.2, =0.1.0, =0.1.0, =0.10.0.1 Source cves: CVE-2022-40604 Source advisory: OSV:PYSEC-2022-279...