GHSA-8QHQ-RQ4J-8PRJ Elasticsearch Logstash allows remote attackers to execute arbitrary commands

Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in 1 zabbix.rb or 2 nagiosnsca.rb in outputs/...

Elasticsearch Logstash allows remote attackers to execute arbitrary commands

Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in 1 zabbix.rb or 2 nagiosnsca.rb in outputs/...

Elasticsearch Logstash allows remote attackers to execute arbitrary commands

Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in 1 zabbix.rb or 2 nagiosnsca.rb in outputs/...

Elasticsearch Logstash allows remote attackers to execute arbitrary commands

Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in 1 zabbix.rb or 2 nagiosnsca.rb in outputs/...

GHSA-FMVH-RVQ5-HHJX Matrix Synapse Improper Signature Validation

Matrix Synapse before 0.33.3.1 and 0.33.2.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation...

Matrix Synapse Improper Signature Validation

Matrix Synapse before 0.33.3.1 and 0.33.2.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation...

GHSA-4HHG-8GHQ-VWQ6 Infinispan: Deserialization of untrusted data in the Hot Rod Java client via automatic byte-array deserialization

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks...

Moodle allows attackers to obtain sensitive calendar-event information

calendar/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to obtain sensitive calendar-event information via a web-services request...

GHSA-45RW-4R25-JVG7 Moodle Logged in users could view all calendar events

A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. Note: It was read-only access, user...

CVE-2022-29971

creationtimestamp| type| source ---|---|--- 2022-05-09 22:33:05+00:00| seen| https://t.me/cibsecurity/42203 2022-05-09 22:33:06+00:00| seen| https://t.me/cibsecurity/42204...

triumph-occasion.fr Cross Site Scripting vulnerability OBB-2613493

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-26523

creationtimestamp| type| source ---|---|--- 2022-05-06 16:22:27+00:00| seen| https://t.me/truesecator/2922 2024-11-25 11:50:04+00:00| seen| https://t.me/truesecator/6467 2026-07-26 07:01:47+00:00| seen| https://t.me/zhatez/1103 2026-07-27 00:01:31+00:00| seen| https://t.me/zhatez/1103 2026-07-29...

PT-2022-10035 · Splunk · Splunk Enterprise Indexer

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise Indexer versions 8.1 through 8.1.4 Splunk Enterprise Indexer versions 8.2 through 8.2.0 Description: A crafted request can bypass S2S TCP Token authentication, allowing arbitrary events to be written to an index. This issue...

CVE-2021-41739

A OS Command Injection vulnerability was discovered in Artica Proxy 4.30.000000. Attackers can execute OS commands in cyrus.events.php with GET param logs and POST param rp...

Command injection

A OS Command Injection vulnerability was discovered in Artica Proxy 4.30.000000. Attackers can execute OS commands in cyrus.events.php with GET param logs and POST param rp...

CVE-2021-41739

A OS Command Injection vulnerability was discovered in Artica Proxy 4.30.000000. Attackers can execute OS commands in cyrus.events.php with GET param logs and POST param rp...

Splunk Enterprise 授权问题漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

Artica Proxy 操作系统命令注入漏洞

Artica Proxy is an open source Artica proxy solution from French company Artica. A security vulnerability exists in Artica Proxy version 4.30.000000, which stems from a lack of filtering and escaping in the application's cyrus.events.php GET parameter logs and POST parameter rp. An attacker can...

CVE-2022-20785

creationtimestamp| type| source ---|---|--- 2022-05-04 20:35:28+00:00| seen| https://t.me/cibsecurity/41939 2022-05-06 13:27:21+00:00| seen| https://t.me/vxunderground/748 2024-08-29 06:23:17+00:00| published-proof-of-concept| https://t.me/ARC15INFO/433...

USN-5390-2: Linux kernel (Raspberry Pi) vulnerabilities

David Bouman discovered that the netfilter subsystem in the Linux kernel did not properly validate passed user register indices. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. CVE-2022-1015 David Bouman discovered that the netfilter subsystem in t...