Path traversal

A vulnerability classified as critical has been found in JATOS. Affected is the function ZipUtil of the file modules/common/app/utils/common/ZipUtil.java of the component ZIP Handler. The manipulation leads to path traversal. Upgrading to version 3.7.5-alpha is able to address this issue. The nam...

CVE-2022-4878 JATOS ZIP ZipUtil.java ZipUtil path traversal

A vulnerability classified as critical has been found in JATOS. Affected is the function ZipUtil of the file modules/common/app/utils/common/ZipUtil.java of the component ZIP Handler. The manipulation leads to path traversal. Upgrading to version 3.7.5-alpha is able to address this issue. The nam...

PT-2023-15892 · Jatos · Jatos

Name of the Vulnerable Software and Affected Versions: JATOS versions prior to 3.7.5-alpha Description: A critical vulnerability has been found in JATOS, affecting the ZipUtil function of the ZIP Handler component. This issue leads to path traversal. Recommendations: For versions prior to...

UBUNTU-CVE-2021-4238

Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by...

GoUtils 安全特征问题漏洞

GoUtils is Masterminds open source a library . It provides users with utility functions that manipulate strings in various ways. A security vulnerability exists in Masterminds goutils that stems from the fact that randomly generated alphanumeric strings contain much less entropy than expected, an...

CVE-2020-36628

A vulnerability classified as critical has been found in Calsign APDE. This affects the function handleExtract of the file APDE/src/main/java/com/calsignlabs/apde/build/dag/CopyBuildTask.java of the component ZIP File Handler. The manipulation leads to path traversal. Upgrading to version...

PT-2022-9023 · Calsign · Calsign Apde

Name of the Vulnerable Software and Affected Versions: Calsign APDE versions prior to 0.5.2-pre2-alpha Description: A critical issue has been found in the ZIP File Handler component of Calsign APDE, affecting the handleExtract function in the file...

CVE-2022-41963

BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3 contain a whiteboard grace period that exists to handle delayed messages, but this grace period could be used by attackers to take actions in the few seconds after their access is revoked. The attacker must be a...

Design/Logic Flaw

BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3 contain a whiteboard grace period that exists to handle delayed messages, but this grace period could be used by attackers to take actions in the few seconds after their access is revoked. The attacker must be a...

CVE-2022-41963 BigBlueButton contains Improper Preservation of Permissions for whiteboard

BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3 contain a whiteboard grace period that exists to handle delayed messages, but this grace period could be used by attackers to take actions in the few seconds after their access is revoked. The attacker must be a...

CVE-2022-41963 BigBlueButton contains Improper Preservation of Permissions for whiteboard

BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3 contain a whiteboard grace period that exists to handle delayed messages, but this grace period could be used by attackers to take actions in the few seconds after their access is revoked. The attacker must be a...

CVE-2022-41962 BigBlueButton contains Incorrect Authorization for setting emoji status

BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6, and 2.5-alpha-1 contain Incorrect Authorization for setting emoji status. A user with moderator rights can use the clear status feature to set any emoji status for other users. Moderators should only be able to s...

CVE-2022-41961 BigBlueButton subject to Ineffective user bans

BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are subject to Ineffective user bans. The attacker could register multiple users, and join the meeting with one of them. When that user is banned, they could still join the meeting with the remaining registered...

PT-2023-20180 · Binutils +4 · Binutils +4

Name of the Vulnerable Software and Affected Versions: Binutils affected versions not specified Description: An out-of-bounds read flaw was found in the parse module function in bfd/vms-alpha.c in Binutils. Recommendations: At the moment, there is no information about a newer version that contain...

GHSA-6RJ8-9CM9-6GFF phpMyFAQ vulnerable to Cross-site Scripting

phpMyFAQ versions 3.1.7 and prior are vulnerable to stored cross-site scripting XSS. A patch is available on the main branch of the repository and anticipated to be part of version 3.2.0-alpha...

phpMyFAQ vulnerable to Cross-site Scripting

phpMyFAQ versions 3.1.7 and prior are vulnerable to stored cross-site scripting XSS. A patch is available on the main branch of the repository and anticipated to be part of version 3.2.0-alpha...

CVE-2022-3608 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

Cross-site Scripting XSS - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-alpha...

PT-2022-23168 · Phpmyfaq · Phpmyfaq

Name of the Vulnerable Software and Affected Versions: phpMyFAQ versions prior to 3.2.0-alpha Description: The issue is related to stored Cross-site Scripting XSS in the phpMyFAQ repository. A patch for this issue is available on the main branch of the repository and is expected to be included in...

LP token price calculation suceptible to oracle attack manipulation

Lines of code Vulnerability details Impact The current calculation of the LP token its no accurate. Currently you formula is a the sum of the underlying asset value; sumPiRi / supply Sumatory of each token prices times reserve, divided by total supply, but this is suceptible to oracle manipulatio...

Systematic Alpha Management FIX Adapter 路径遍历漏洞

Systematic Alpha Management FIX Adapter is an adapter from Systematic Alpha Management, USA. A security vulnerability exists in Systematic Alpha Management FIX Adapter ALFAFX version 2.4.0.25 13/09/2017, which stems from a vulnerability that allows remote files to be included via UNC shared...