910 matches found
CVE-2022-37933
A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers. The vulnerability could be exploited to allow local unauthorized data injection. HPE has made the following software updates to resolve the vulnerability in HPE Superdome Flex firmware...
CVE-2022-37933
HPE Superdome Flex and Superdome Flex 280 servers are affected by CVE-2022-37933. Affects: HPE Superdome Flex firmware 3.60.50 and below; HPE Superdome Flex 280 firmware 1.40.60 and below. Issue causes local unauthorized data injection. Remediation: upgrade to firmware versions above 3.60.50 (for...
PT-2023-13558 · Hewlett Packard · Hpe Superdome Flex +1
Name of the Vulnerable Software and Affected Versions: HPE Superdome Flex versions 3.60.50 and below HPE Superdome Flex 280 servers versions 1.40.60 and below Description: A potential security issue has been identified in HPE Superdome Flex and Superdome Flex 280 servers, which could allow local...
CVE-2022-34324
Multiple SQL injections in Sage XRT Business Exchange 12.4.302 allow an authenticated attacker to inject malicious data in SQL queries: Add Currencies, Payment Order, and Transfer History...
CLSA-2022-1671124508 Fix CVE(s): CVE-2021-23222
SECURITY UPDATE: A man-in-the-middle attacker can inject false responses - debian/patches/CVE-2021-23222.patch: libpq: reject extraneous data after SSL or GSS encryption handshake - CVE-2021-23222...
nodejs: Incorrect handling of certificate subject and issuer fields
A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries...
mina-sshd: Java unsafe deserialization vulnerability
A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server...
Cross-Site Scripting (XSS)
yikesinc/yikes-inc-easy-mailchimp-extender is vulnerable to cross-site scripting. The vulnerability exists because of unsanitized form data used in the addfieldtoform.php, allowing an attacker to inject and execute malicious JavaScript...
curl: FTP-KRB bad message verification
A vulnerability was found in curl. This issue occurs because it mishandles message verification failures when curl does FTP transfers secured by krb5. This flaw makes it possible for a Man-in-the-middle attack to go unnoticed and allows data injection into the client...
curl: FTP-KRB bad message verification
A vulnerability was found in curl. This issue occurs because it mishandles message verification failures when curl does FTP transfers secured by krb5. This flaw makes it possible for a Man-in-the-middle attack to go unnoticed and allows data injection into the client...
AlmaLinux 9 : kernel-rt (ALSA-2022:7933)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:7933 advisory. - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an...
kernel: off-path attacker may inject data or terminate victim's TCP session
A TCP/IP packet spoofing attack flaw was found in the Linux kernel’s TCP/IP protocol, where a Man-in-the-Middle Attack MITM performs an IP fragmentation attack and an IPID collision. This flaw allows a remote user to pretend to be the sender of the TCP/IP packet for an existing TCP/IP session...
nodejs: Incorrect handling of certificate subject and issuer fields
A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries...
RHEL 8 : kernel-rt (RHSA-2022:7444)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7444 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...
WordPress plugin Activity Log 注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection
A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the extend function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with...
Internet Bug Bounty: POST following PUT confusion
The bug I submitted at https://github.com/curl/curl/issues/9507 can have at least a few unintended security issues: Information Disclosure: this bug causes an HTTP PUT to occur when the user intends for an HTTP POST to occur. The user, who intended an HTTP POST, expects the POSTed information to...
Cross-Site Scripting (XSS)
apache-geode is vulnerable to cross-site scripting. The vulnerability exists in multiple functions due to data injection when using pulse web application which allows an attacker to steal the admin's session cookie for the admin account...
Apache Geode vulnerable to Cross-Site Scripting
Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting XSS via data injection when using Pulse web application to view Region entries...
