3777 matches found
CVE-2022-31567
The DSABenchmark/DSAB repository through 2.1 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
HCL Technologies HCL Launch Information Disclosure Vulnerability (CNVD-2022-58411)
HCL Technologies HCL Launch is a versatile, enterprise-grade continuous delivery automation software from HCL Technologies, India. for handling the most complex deployment processes in DevOps. HCL Technologies HCL Launch suffers from an information disclosure vulnerability that stems from the...
A Bootiful Podcast: Kubernetes contributor and fellow Tanzu Developer Advocate Leigh Capili
Hi, Spring fans! In this installment Josh Long @starbuxman talks to fellow teammate and Kubernetes ecosystem legend Leigh Capili @capileigh about Gitops, Kubernetes, Puppet/Chef, continuous delivery, how zoom scales if you deploy on-prem, being a developer advocate, Flux, and so much more...
The vulnerability of the Citrix Application Delivery Management (ADM) delivery service lies in the insufficient control over resources during its existence. This allows a malicious actor to cause a temporary interruption of the ADM licensing service.
The vulnerability of the Citrix Application Delivery Management ADM delivery management service is related to insufficient control over resources during its existence. Exploiting this vulnerability could allow a malicious actor to cause a temporary disruption in the ADM licensing service’s...
The vulnerability of the Citrix Application Delivery Management (ADM) platform’s management service, related to access control deficiencies, allows a hacker to bypass the administrator password and increase their privileges.
The vulnerability of the Citrix Application Delivery Management ADM delivery management platform is related to lack of access control mechanisms. Exploiting this vulnerability could allow a malicious actor to bypass the administrator’s password and gain increased privileges...
secureCodeBox (SCB) - Continuous Secure Delivery Out Of The Box
secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. For additional documentation aspects please have a look at our documentation website:...
VDA Registration in Citrix Cloud Explained
This article explains how to register your cloud VDA...
Design/Logic Flaw
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD's repo-server. A malicious Argo CD user...
CVE-2022-31036 Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD's repo-server. A malicious Argo CD user...
CVE-2022-31036
CVE-2022-31036 : Argo CD versions starting at v1.3.0 are vulnerable to a symlink-following bug in the repo-server, allowing a malicious user with repository write access to leak YAML files from other applications or secrets if the target is a valid YAML file. Patches exist in v2.4.1, v2.3.5, v2.2...
CVE-2022-1113
The Flower Delivery by Florist One WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setups...
CVE-2022-1113
The Flower Delivery by Florist One WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setups...
Cross site scripting
The Flower Delivery by Florist One WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setups...
CVE-2022-1113
The CVE-2022-1113 entry concerns the WordPress plugin “Flower Delivery by Florist One” (versions up to 3.7). The vulnerability arises because the plugin does not sanitize and escape several settings, enabling Stored Cross-Site Scripting (Stored XSS) by high-privilege users (e.g., admins) when the...
PT-2022-13667 · WordPress · The Flower Delivery By Florist One
Name of the Vulnerable Software and Affected Versions: The Flower Delivery by Florist One WordPress plugin versions 3.7 and earlier Description: The issue allows high privilege users, such as admin, to perform Stored Cross-Site Scripting attacks when the unfiltered html capability is disallowed,...
WordPress plugin Flower Delivery 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Flower Delivery by Florist One versions prior to 3.5.10 have a cross-site scripting...
Linux kernel 代码问题漏洞
Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel suffers from a code issue vulnerability that stems from a NULL pointer dereference problem in kvmirqdeliverytoapicfast. An attacker exploiting this vulnerability could trigger a denial of...
Malicious code in tesla-pre-delivery-onboarding (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b84e54272fec2aa922381b0f60c14edb7296ceb05ee946e8d469d170f039078b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Frostbyte - FrostByte Is A POC Project That Combines Different Defense Evasion Techniques To Build Better Redteam Payloads
FrostByte Progolue: In the past few days I've been experimenting with the AppDomain manager injection technique had a decent success with it in my previous Red Team engagements against certain EDRs. Although, this is really good for initial access vector, I wanted to release a POC which will help...