323 matches found
CVE-2024-40348
An issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a directory traversal...
CVE-2024-40348
An issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a directory traversal...
CVE-2024-40348
The software Bazarr (v1.4.3 and earlier) contains an arbitrary file read vulnerability due to a directory traversal flaw in the /api/swaggerui/static component. This flaw allows unauthenticated attackers to read arbitrary files from the server, such as /etc/passwd . Several proof-of-concept explo...
hod security breach
hod is an open source library from Cafe Bazaar. A security vulnerability exists in hod version v0.4.14, which originates from the inclusion of prototype contamination via the function request, allowing an attacker to execute arbitrary code or cause a denial of service DoS by injecting arbitrary...
CVE-2024-39015: Improper Control of Generation of Code
cafebazaar hod v0.4.14 was discovered to contain a prototype pollution via the function request. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...
RHEL 6 : bzr (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - bzr: does not strip bzr+ssh SSH options CVE-2017-14176 Note that Nessus has not tested for this issue but has inste...
zcap 安全漏洞
zcap is an open source reference implementation library for linked data functions from Digital Bazaar. A security vulnerability exists in zcap versions prior to v9.0.1, which stems from a security issue with the expiration check in Incomplete expiration that allows calls outside of the expected...
PT-2024-24345 · Digital Bazaar · @Digitalbazaar/Zcap
Name of the Vulnerable Software and Affected Versions: @digitalbazaar/zcap versions prior to 9.0.1 Description: The issue arises when invoking a capability with a chain depth of 2, where the expires property is not properly checked against the current date or other date param. This can allow...
Incognito Darknet Market Mass-Extorts Buyers, Sellers
Borrowing from the playbook of ransomware purveyors, the darknet narcotics bazaar Incognito Market has begun extorting all of its vendors and buyers, threatening to publish cryptocurrency transaction and chat records of users who refuse to pay a fee ranging from $100 to $20,000. The bold mass...
200+ Malicious Android Apps Targeting Iranian Banks: Experts Warn
An Android malware campaign targeting Iranian banks has expanded its capabilities and incorporated additional evasion tactics to fly under the radar. That's according to a new report from Zimperium, which discovered more than 200 malicious apps associated with the malicious operation, with the...
Oracle Linux 7 : wireshark (ELSA-2020-1047)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1047 advisory. - Resolves: 1557212 - CVE-2018-7418 SIGCOMP dissector crash in packet-sigcomp.c - Resolves: 1588208 - CVE-2018-11362 Out-of-bounds Read in packet-ldss....
CVE-2023-2813
All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1.13, Atlast Business WordPress theme through 1.5.8.5, Bazaar Lite WordPress theme before 1.8.6, Brain Power WordPress theme through 1.2,...
CVE-2023-2813 Multiple Themes - Reflected XSS
All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1.13, Atlast Business WordPress theme through 1.5.8.5, Bazaar Lite WordPress theme before 1.8.6, Brain Power WordPress theme through 1.2,...
CVE-2023-2813: Undefined Security Weakness
All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1.13, Atlast Business WordPress theme through 1.5.8.5, Bazaar Lite WordPress theme before 1.8.6, Brain Power WordPress theme through 1.2,...
WordPress Bazaar Lite Theme <= 1.8.5 is vulnerable to Cross Site Scripting (XSS)
Software Bazaar Lite Type Theme Vulnerable versions = 1.8.5 Fixed in 1.8.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2813 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d9553f419d38 Credits Random Robbie Required...
Cross-Site Request Forgery (CSRF)
bazaar is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists because the library does not require POST requests for an HTTP endpoint, which allows an attacker to delete previously created Bazaar SCM tags...
GHSA-6F4Q-F5FJ-Q6FC CSRF vulnerability in Bazaar Plugin
Jenkins Bazaar Plugin 1.22 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to delete previously created Bazaar SCM tags...
CSRF vulnerability in Bazaar Plugin
Jenkins Bazaar Plugin 1.22 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to delete previously created Bazaar SCM tags...
