14319 matches found
CVE-2022-23775
TrueStack Direct Connect 1.4.7 has Incorrect Access Control...
CVE-2022-23775
TrueStack Direct Connect 1.4.7 has Incorrect Access Control...
Improper access control
TrueStack Direct Connect 1.4.7 has Incorrect Access Control...
CVE-2022-23775
TrueStack Direct Connect 1.4.7 is affected by Incorrect Access Control (CVE-2022-23775). The issue is described across multiple sources as affecting version 1.4.7 and has high/critical impact on confidentiality, integrity, and availability. Remediation: upgrade to a fixed version (the vendor refe...
CVE-2022-23775
TrueStack Direct Connect 1.4.7 has Incorrect Access Control...
TrueStack Direct Connect 安全漏洞
TrueStack Direct Connect is a VPN management server from TrueStack USA, Inc. for easily connecting Windows and Mac computers to Windows domain controllers and file servers in the AWS cloud. A security vulnerability exists in TrueStack Direct Connect 1.4.7 that stems from incorrect application...
PT-2022-16261 · Truestack · Truestack Direct Connect
Name of the Vulnerable Software and Affected Versions: TrueStack Direct Connect version 1.4.7 Description: The issue is related to Incorrect Access Control. Recommendations: For version 1.4.7, update to a version that addresses the Incorrect Access Control issue...
GHSA-4V96-M8XV-X83V Broken Authentication in Atlassian Connect Express
Broken Authentication in Atlassian Connect Express ACE from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or...
@nexus-switchboard/nexus-conn-jira (>=0.1.0, <=0.2.2), @nexus-switchboard/nexus-mod-service (>=0.4.1, <=0.6.3) +1 more potentially affected by CVE-2021-26073 via atlassian-connect-express (>=3.5.2, <=4.4.1)
atlassian-connect-express NPM version =3.5.2, =0.1.0, =0.4.1, =0.0.1, =2.0.5 Source cves: CVE-2021-26073 Source advisory: OSV:GHSA-4V96-M8XV-X83V...
Broken Authentication in Atlassian Connect Express
Broken Authentication in Atlassian Connect Express ACE from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or...
OS command execution vulnerability in Perfecto Plugin
Perfecto Plugin allows specifying Perfecto Connect Path and Perfecto Connect File Name in job configurations. This command is executed on the Jenkins controller in Perfecto Plugin 1.17 and earlier, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controlle...
GHSA-P364-XFP2-F9RR CSRF vulnerability in Jenkins Fortify on Demand Plugin
A cross-site request forgery vulnerability in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs. This form validation method requires appropriate permission in Fortify on...
Elastic Stack 7.17.4 and 8.2.1 Security Update
Elastic Stack update for CVE-2022-21449 Java vulnerability in Elliptic Curve Digital Signature Algorithm ECDSA ESA-2022-06 A vulnerability CVE-2022-21449 affecting the implementation of Elliptic Curve Digital Signing Algorithm ECDSA based signatures verification in Java JDK versions 15 and later...
Security Bulletin: IBM App Connect Enterprise Certified Container Operator may be vulnerable to denial of service due to CVE-2021-38561
Summary Golang Go Text is used by IBM App Connect Enterprise Certified Container Operator internally. The Operator may be vulnerable to denial of service if a Golang panic is triggered. This bulletin provides patch information to address the reported vulnerability CVE-2021-38561. Vulnerability...
VulnCheck KEV: CVE-2022-29499
The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation...
bigrest (>=1.2.5, <=1.5.8), cloudant_boilerplate_nodejs (0.0.2) +18 more potentially affected by CVE-2022-29623 via connect-multiparty (>=2.0.0, <=2.1.1)
connect-multiparty NPM version =2.0.0, =1.2.5, =1.0.1, =1.9.24, =0.6.5, =0.0.3, =0.0.4, =0.0.60, =2.0.2, =3.5.0, =0.6.1, =0.6.217 and more Source cves: CVE-2022-29623 Source advisory: OSV:GHSA-W2XW-44R3-4V9G...
Connect-Multiparty allows arbitrary file upload
An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary code via a crafted PDF file. NOTE: the Supplier has not verified this vulnerability report...
GHSA-W2XW-44R3-4V9G Connect-Multiparty allows arbitrary file upload
An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary code via a crafted PDF file. NOTE: the Supplier has not verified this vulnerability report...
CVE-2022-29623
An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary code via a crafted PDF file. NOTE: the Supplier has not verified this vulnerability report...