8713 matches found
CVE-2021-28161
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected...
CVE-2021-28161
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected...
CVE-2021-28161
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected...
Code injection
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected...
CVE-2021-28161
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected...
Eclipse Theia 跨站脚本漏洞
Eclipse Theia is the Eclipse Foundation's set of Visual Studio Code-based open source integrated development environment for desktop and Web applications framework. A cross-site scripting vulnerability exists in Eclipse Theia 1.8.0 and prior versions, which stems from the absence of HTML escaping...
EPA scan results are not getting displayed in ns.log when EPA policies are configured through N-Factor Authentication.
When EPA policies are configured through N-Factor Authentication, then EPA Scan results will not be displayed in the ns.log despite Debug log level is enabled...
Security Bulletin: IBM Verify Gateway PAM components do not set restricted access permission for debug logs (CVE-2020-4405)
Summary To debug the IBM Verify Gateway IVG PAM components, customers can add "trace-file" parameters in the PAM configuration so that .log files are written to the /tmp directory. These debug logs potentially contain sensitive information, and yet they default to world readable. They should have...
Security Bulletin: IBM Verify Gateway does not hide client secrets when debug tracing is active (CVE-2020-4372)
Summary When the IBM Verify Gateway IVG components are run with debug tracing, client secrets such as the username, password, and client-id are included in the debug log. As of v1.0.1 of IVG for RADIUS and IVG for AIX PAM, and v1.0.2 of IVG for Linux PAM and IVG for Windows Login, these client...
Security Bulletin: IBM Verify Gateway PAM components include a leftover debug file (CVE-2020-4371)
Summary The IBM Verify Gateway IVG PAM components include a leftover header file in their installation packages. The file was needed for debugging during development and shouldn't be part of the delivered PAM components. As of v1.0.1 of IVG for AIX PAM, and v1.0.2 of IVG for Linux PAM, the file h...
nodejs:10 security update
nodejs 1:10.24.0-1 - Resolves: RHBZ1932373, RHBZ1932426 - Resolves CVE-2021-22883 and CVE-2021-22884 - remove -debug-nghttp2 flag 1930775 - remove ini patch merged upstream...
nodejs:12 security update
nodejs 1:12.21.0-1 - Resolves: RHBZ1932315, RHBZ1932424 - remove --debug-nghttp2 option - remove ini patch - Backport patch to use getauxval...
Cross-Site Scripting (XSS)
nanohttpd is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript code in a user's browser via the GeneralHandler class that implements a basic GET handler which prints debug information as an HTML page...
Owncloud ownCloud 权限许可和访问控制问题漏洞
OwnCloud OwnCloud is a personal cloud storage solution from OwnCloud Owncloud, an American company. OwnCloud has a permission and access control issue vulnerability that can be exploited by an attacker to bypass the PIN locking feature by making a restore from this archive, using adb to include t...
Information disclosure
Debug message containing addresses of memory transactions in some IntelR 10th Generation Core Processors supporting SGX may allow a privileged user to potentially enable information disclosure via local access...
CVE-2020-24491
Debug message containing addresses of memory transactions in some IntelR 10th Generation Core Processors supporting SGX may allow a privileged user to potentially enable information disclosure via local access...
CVE-2020-24491
CVE-2020-24491 concerns a potential information disclosure in Intel SGX on some 10th Generation Intel Core processors. The issue is triggered by a debug message that reveals addresses of memory transactions, which a privileged user could use to disclose information via local access. Affected prod...
CVE-2020-4954
IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper session validation . By using the configuration panel to obtain a valid session using an attacker controlled IBM Spectrum Protect server, an attacker could...
Authentication flaw
IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper session validation . By using the configuration panel to obtain a valid session using an attacker controlled IBM Spectrum Protect server, an attacker could...
CVE-2020-4954
IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper session validation . By using the configuration panel to obtain a valid session using an attacker controlled IBM Spectrum Protect server, an attacker could...