TrueStack Direct Connect 安全漏洞

TrueStack Direct Connect is a VPN management server from TrueStack USA, Inc. for easily connecting Windows and Mac computers to Windows domain controllers and file servers in the AWS cloud. A security vulnerability exists in TrueStack Direct Connect 1.4.7 that stems from incorrect application...

PT-2022-16261 · Truestack · Truestack Direct Connect

Name of the Vulnerable Software and Affected Versions: TrueStack Direct Connect version 1.4.7 Description: The issue is related to Incorrect Access Control. Recommendations: For version 1.4.7, update to a version that addresses the Incorrect Access Control issue...

GHSA-4V96-M8XV-X83V Broken Authentication in Atlassian Connect Express

Broken Authentication in Atlassian Connect Express ACE from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or...

@nexus-switchboard/nexus-conn-jira (>=0.1.0, <=0.2.2), @nexus-switchboard/nexus-mod-service (>=0.4.1, <=0.6.3) +1 more potentially affected by CVE-2021-26073 via atlassian-connect-express (>=3.5.2, <=4.4.1)

atlassian-connect-express NPM version =3.5.2, =0.1.0, =0.4.1, =0.0.1, =2.0.5 Source cves: CVE-2021-26073 Source advisory: OSV:GHSA-4V96-M8XV-X83V...

Broken Authentication in Atlassian Connect Express

Broken Authentication in Atlassian Connect Express ACE from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or...

OS command execution vulnerability in Perfecto Plugin

Perfecto Plugin allows specifying Perfecto Connect Path and Perfecto Connect File Name in job configurations. This command is executed on the Jenkins controller in Perfecto Plugin 1.17 and earlier, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controlle...

GHSA-P364-XFP2-F9RR CSRF vulnerability in Jenkins Fortify on Demand Plugin

A cross-site request forgery vulnerability in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs. This form validation method requires appropriate permission in Fortify on...

Elastic Stack 7.17.4 and 8.2.1 Security Update

Elastic Stack update for CVE-2022-21449 Java vulnerability in Elliptic Curve Digital Signature Algorithm ECDSA ESA-2022-06 A vulnerability CVE-2022-21449 affecting the implementation of Elliptic Curve Digital Signing Algorithm ECDSA based signatures verification in Java JDK versions 15 and later...

Security Bulletin: IBM App Connect Enterprise Certified Container Operator may be vulnerable to denial of service due to CVE-2021-38561

Summary Golang Go Text is used by IBM App Connect Enterprise Certified Container Operator internally. The Operator may be vulnerable to denial of service if a Golang panic is triggered. This bulletin provides patch information to address the reported vulnerability CVE-2021-38561. Vulnerability...

bigrest (>=1.2.5, <=1.5.8), cloudant_boilerplate_nodejs (0.0.2) +18 more potentially affected by CVE-2022-29623 via connect-multiparty (>=2.0.0, <=2.1.1)

connect-multiparty NPM version =2.0.0, =1.2.5, =1.0.1, =1.9.24, =0.6.5, =0.0.3, =0.0.4, =0.0.60, =2.0.2, =3.5.0, =0.6.1, =0.6.217 and more Source cves: CVE-2022-29623 Source advisory: OSV:GHSA-W2XW-44R3-4V9G...

Connect-Multiparty allows arbitrary file upload

An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary code via a crafted PDF file. NOTE: the Supplier has not verified this vulnerability report...

GHSA-W2XW-44R3-4V9G Connect-Multiparty allows arbitrary file upload

An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary code via a crafted PDF file. NOTE: the Supplier has not verified this vulnerability report...

CVE-2022-29623

An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary code via a crafted PDF file. NOTE: the Supplier has not verified this vulnerability report...

Design/Logic Flaw

An arbitrary file upload vulnerability in the file upload module of Connect-Multiparty v2.2.0 allows attackers to execute arbitrary code via a crafted PDF file...

CVE-2022-29623

An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary code via a crafted PDF file. NOTE: the Supplier has not verified this vulnerability report...

CVE-2022-29623

An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary code via a crafted PDF file. NOTE: the Supplier has not verified this vulnerability report...

CVE-2022-29623

CVE-2022-29623 describes an arbitrary file upload vulnerability in the file upload module of Connect-Multiparty 2.2.0 (Express Connect-Multiparty). The underlying issue allows an attacker to execute arbitrary code by supplying a crafted PDF file. The vulnerability is documented across multiple so...

PT-2022-19733 · Unknown · Connect-Multiparty

Name of the Vulnerable Software and Affected Versions: Connect-Multiparty version 2.2.0 Description: An arbitrary file upload vulnerability in the file upload module allows attackers to execute arbitrary code via a crafted PDF file. Recommendations: For Connect-Multiparty version 2.2.0, consider...

Connect-Multiparty 代码问题漏洞

Connect-Multiparty is a module. It is used for Connect-Multiparty middleware. A code issue vulnerability exists in Connect-Multiparty version 2.2.0, which stems from an arbitrary file upload issue in the File Upload module. An attacker can execute arbitrary code via a crafted PDF file...

Auth0-ASPNET and Auth0-ASPNET-Owin vulnerable to Cross-Site Request Forgery

An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations...