21436 matches found
USN-7061-1 golang-1.17 vulnerabilities
Hunter Wittenborn discovered that Go incorrectly handled the sanitization of environment variables. An attacker could possibly use this issue to run arbitrary commands. CVE-2023-24531 Sohom Datta discovered that Go did not properly validate backticks as Javascript string delimiters, and did not...
PT-2024-33316 · Snipe-It · Snipe-It
Name of the Vulnerable Software and Affected Versions: Snipe-IT versions prior to 7.0.10 Description: The issue allows remote code execution when an attacker knows the APP KEY, which is associated with cookie serialization. This is worsened by the availability of .env files from the product's...
The Future of Cybersecurity Risk Management: Risk Operations Center (ROC) delivered by Qualys Enterprise TruRisk™ Management (ETM)
" A problem well defined is a problem half solved." – Charles Kettering In today’s digital landscape, organizations are overwhelmed with risk signals from all directions—cloud vulnerabilities, misconfigurations in custom code, operational technology OT gaps, and third-party integrations, to name ...
Malicious code in nanoslackts-env-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe61e9c24b26d76088e167848056dfe52c47156a72948c418b51b949e65b3e05 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Adobe Substance 3D Stager 缓冲区错误漏洞
Adobe Substance 3D Stager is a virtual 3D studio from Audobee Adobe USA. Adobe Substance 3D Stager suffers from a buffer error vulnerability that stems from allowing out-of-bounds writes to memory. An attacker exploiting this vulnerability could execute arbitrary code in the current user's...
Adobe Substance 3D Stager 缓冲区错误漏洞
Adobe Substance 3D Stager is a virtual 3D studio from Audobee Adobe USA. Adobe Substance 3D Stager suffers from a buffer error vulnerability that stems from allowing out-of-bounds writes to memory. An attacker exploiting this vulnerability could execute arbitrary code in the current user's...
Adobe Framemaker 数字错误漏洞
Adobe Framemaker is the United States of America Odooby Adobe company's set of page layout software for writing and editing large or complex documents including structured documents. A numeric error vulnerability exists in Adobe Framemaker that stems from an integer underflow. An attacker could...
EulerOS 2.0 SP11 : orc (EulerOS-SA-2024-2589)
According to the versions of the orc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially...
Huawei EulerOS: Security Advisory for orc (EulerOS-SA-2024-2589)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
EulerOS 2.0 SP11 : orc (EulerOS-SA-2024-2563)
According to the versions of the orc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially...
Adobe Substance 3D Stager 安全漏洞
Adobe Substance 3D Stager is a virtual 3D studio from the American company Audobee Adobe. A security vulnerability exists in Adobe Substance 3D Stager. An attacker could exploit the vulnerability to execute arbitrary code in the current user's environment...
Adobe Substance 3D Stager 安全漏洞
Adobe Substance 3D Stager is a virtual 3D studio from the American company Audobee Adobe. A security vulnerability exists in Adobe Substance 3D Stager that originates from a heap-based buffer overflow. An attacker could exploit the vulnerability to execute arbitrary code in the current user's...
CentOS 7 : java-1.8.0-ibm (RHSA-2022:6756)
The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6756 advisory. - Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions...
CVE-2024-47773
Discourse CVE-2024-47773 describes an anonymous cache-poisoning vulnerability triggered by multiple XHR requests that can contaminate the cache for anonymous visitors. Affected software is Discourse (noted in multiple sources) with patches in the latest released version; remediation guidance also...
CVE-2024-47773 Anonymous cache poisoning via XHR requests in Discourse
Discourse is an open source platform for community discussion. An attacker can make several XHR requests until the cache is poisoned with a response without any preloaded data. This issue only affects anonymous visitors of the site. This problem has been patched in the latest version of Discourse...
Exploit for Deserialization of Untrusted Data in Flask-Caching_Project Flask-Caching
It is an offensive tool for web exploitation. This PoC exploit t...
Vulnerabilities fixed in Siemens products
Siemens has fixed vulnerabilities in several products such as Questa/ModelSIM, RUGGEDCOM, SENTRON, SIMATIC, SINEC, Tecnomatix and Teamcenter. The vulnerabilities potentially enable a malicious person to carry out attacks that can lead to the following categories of damage: - Denial-of-Service DoS...
Expected Behavior Violation
@backstage/plugin-app-backend is vulnerable to Expected Behavior Violation. The vulnerability is due to the handling of APPCONFIG environment variables, which ignores the visibility defined in the configuration schema. Note: This was an intended feature of the APPCONFIG way of supplying...
