2100 matches found
Security Bulletin: Multiple vulnerabilities affect IBM Db2® REST
Summary IBM has released the below fix for IBM Db2® REST in response to multiple vulnerabilities found in multiple components. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2023-39323 DESCRIPTION: Golang Go could allow a remote attacker to execute arbitrary code on the...
OWASP.AntiSamy mXSS when preserving comments
Impact There is a potential for a mutation XSS mXSS vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the preserveComments directive must be enabled in your policy file and also allow for certain tags at the same time. As a result,...
PT-2024-2674 · Yasm +2 · Yasm +2
Name of the Vulnerable Software and Affected Versions: YASM version 1.3.0.86.g9def Description: The issue is related to a Use After Free vulnerability in the do directive function, located in the modules/preprocs/nasm/nasm-pp.c component. This vulnerability allows a remote attacker to cause a...
YASM Security Vulnerabilities
yasm is a completely rewritten Netwide assembler from the yasm open source. A security vulnerability exists in YASM 1.3.0.86.g9def, which stems from the presence of a post-release reuse vulnerability. An attacker can exploit this vulnerability to cause a denial of service DOS via the dodirective...
CVE-2023-6971
The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. NOTE: Successful exploitation of...
PT-2023-7884
Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 9.6 Description The issue is related to OS command injection in OpenSSH, which might occur if a user name or host name has shell metacharacters and this name is referenced by an expansion token in certain situations...
CVE-2023-50463
The caddy-geo-ip aka GeoIP middleware through 0.6.0 for Caddy 2, when trustheader X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism trustedproxy directive in reverseproxy or IP address range restrictio...
CVE-2023-50463
The caddy-geo-ip aka GeoIP middleware through 0.6.0 for Caddy 2, when trustheader X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism trustedproxy directive in reverseproxy or IP address range restrictio...
golang: cmd/go: line directives allows arbitrary execution during build
A flaw was found in the golang cmd/go standard library. A line directive "//line" can be used to bypass the restrictions on "//go:cgo" directives, allowing blocked linker and compiler flags to pass during compilation. This can result in the unexpected execution of arbitrary code when running "go...
What is NIS2, and how can you best prepare for the new cybersecurity requirements in the EU?
NIS2 is a European directive that includes new measures to ensure that organizations operating in the European Union EU have a high common level of network and infrastructure security. The "directive" outlines the goals all EU member states must achieve. However, each country will implement it in...
ROS-20231109-01
Go programming language vulnerability is related to insecure external control of critical state data state when processing the setuid and setgid attributes. Exploitation of the vulnerability could allow an attacker, acting remotely, escalate their privileges and gain access to read, modify, or...
YouTube's Ad Blocker Detection Believed to Break EU Privacy Law
A complaint filed with the EU’s independent data regulator accuses YouTube of failing to get explicit user permission for its ad blocker detection system, potentially violating the ePrivacy Directive...
BIT-NGINX-INGRESS-CONTROLLER-2022-41743
NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngxhttphlsmodule that might allow a local attacker to corrupt NGINX worker memory, resulting in its crash or potential other impact using a specially crafted audio or video file. The issue affects only NGINX Plus when...
Go //line Code Execution
The vulnerability of the “//line” directive in the Go programming language is related to errors in data processing during syntax analysis of code. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
GHSA-GVRM-W2F9-F77Q Ingress-nginx path sanitization can be bypassed
Ingress-nginx path sanitization can be bypassed with logformat directive...
Ingress-nginx path sanitization can be bypassed
Ingress-nginx path sanitization can be bypassed with logformat directive...
CVE-2022-4886
Ingress-nginx path sanitization can be bypassed with logformat directive...
Code injection
Ingress-nginx path sanitization can be bypassed with logformat directive...
