38 matches found
CVE-2024-31137
In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration...
CVE-2024-31137
Summary: CVE-2024-31137 affects JetBrains TeamCity versions prior to 2024.03, where the Space connection configuration component can cause a reflected XSS. The root cause is insufficient protection of the web page structure in the Space configuration flow, allowing an attacker to inject/script vi...
CVE-2024-31137
In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration...
CVE-2024-31137
In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration...
CVE-2024-31137: Improper Neutralization of Input During Web Page Generation
In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration...
Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions Op or Admin to change the connection object in this...
CVE-2023-33234 Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions Op or Admin to change the connection object in this...
CVE-2023-33234 Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions Op or Admin to change the connection object in this...
Improper access control
Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing...
CVE-2021-35299: Insertion of Sensitive Information into Log File
Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing...
Information Disclosure
nat.js is vulnerable to information disclosure. The vulnerability exists as it leaks options to the NATS server, including TLS private credentials, when Mutual TLS is used, where the credentials for the TLS client keys are included in the connection configuration options...
Sensitive data exposure in NATS
Preview versions of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server; for one package, this includes TLS private credentials. The connection configuration options in these JavaScript-based implementations were...
AVEVA InduSoft Web Studio / InTouch Edge HMI Command 66 RCE
Binary data scadaavevaiwsitehcmd66rce.nbin...
CVE-2019-6545
AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI formerly InTouch Machine Edition prior to Version 2017 Update. An unauthenticated remote user could use a specially crafted database connection configuration file to execute an arbitrary process on the server...
CVE-2019-6545: Improper Control of Resource Identifiers
AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI formerly InTouch Machine Edition prior to Version 2017 Update. An unauthenticated remote user could use a specially crafted database connection configuration file to execute an arbitrary process on the server...
Large power online online distance learning platform 0DAY National Electrical chase to eat)-vulnerability warning-the black bar safety net
Brief description: Long time of vulnerability, the vendor iswww.open.edu.cn, today finishing the blog found this 0day can also use the publication to the next. A plurality of injection vulnerabilities, filtering and etc. but can bypass the database connection configuration file is exposed,...