6407 matches found
Express.js 安全漏洞
Express.js is Express.js open source a fast, unconstrained, minimalist web framework for Node.js. A security vulnerability exists in Express.js versions prior to 4.19.0, 5.0, which stems from allowing open redirects with malformed URLs...
GHSA-882J-4VJ5-7VMJ Cache Poisoning Vulnerability
Summary An attacker controlling the second variable of the translate function is able to perform a cache poisoning attack. They can change the outcome of translation requests made by subsequent users. Details The opt.id parameter allows the overwriting of the cache key. If an attacker sets the id...
USN-6686-3 linux-oracle, linux-oracle-5.15 vulnerabilities
It was discovered that the DesignWare USB3 for Qualcomm SoCs driver in the Linux kernel did not properly handle certain error conditions during device registration. A local attacker could possibly use this to cause a denial of service system crash. CVE-2023-22995 It was discovered that a race...
SUSE CVE-2024-26611
In the Linux kernel, the following vulnerability has been resolved: xsk: fix usage of multi-buffer BPF helpers for ZC XDP Currently when packet is shrunk via bpfxdpadjusttail and memory type is set to MEMTYPEXSKBUFFPOOL, null ptr dereference happens: 1136314.192256 BUG: kernel NULL pointer...
UBUNTU-CVE-2024-26611
In the Linux kernel, the following vulnerability has been resolved: xsk: fix usage of multi-buffer BPF helpers for ZC XDP Currently when packet is shrunk via bpfxdpadjusttail and memory type is set to MEMTYPEXSKBUFFPOOL, null ptr dereference happens: 1136314.192256 BUG: kernel NULL pointer...
Enhancing Object Storage Performance: Introducing NVMe Hardware and Expanded Capacity
...
BIT-HANDLEBARS-2021-32817 File disclosure in express-hbs
express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability...
BIT-HANDLEBARS-2021-32820 File disclosure in Express Handlebars
Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential...
UBUNTU-CVE-2024-26623
In the Linux kernel, the following vulnerability has been resolved: pdscore: Prevent race issues involving the adminq There are multiple paths that can result in using the pdsc's adminq. 1 pdscadminqisr and the resulting work from queuework, i.e. pdscworkthread-pdscprocessadminq 2 pdscadminqpost...
American Express warns customers about third party data breach
American Express has sent affected customers a warning that “a third party service provider engaged by numerous merchants experienced unauthorized access to its system.” In a subsequent update, American Express explained that it was not a service provider, but a merchant processor that suffered t...
American Express Cardholders Impacted by Third-Party Vendor Data Breach
By Waqas Another day, another third-party data breach! This is a post from HackRead.com Read the original post: American Express Cardholders Impacted by Third-Party Vendor Data Breach...
CVE-2023-32331
IBM Connect:Express for UNIX 1.5.0 is vulnerable to a buffer overflow that could allow a remote attacker to cause a denial of service through its browser UI. IBM X-Force ID: 254979...
The vulnerability of the `register_vfs()` function (hw/pci/pcie_sriov.c) in the QEMU hardware/software emulator allows a attacker to cause a service failure.
The vulnerability of the registervfs function in the QEMU hardware/PCI/PcieSRIOV.c emulator is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to cause a system failure...
americanexpress.nc Cross Site Scripting vulnerability OBB-3864073
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2024-27298
parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20...
CVE-2024-27298 Parse Server literalizeRegexPart SQL Injection
parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20...
CVE-2024-27298 Parse Server literalizeRegexPart SQL Injection
parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20...
mongo-express Cross-site Request Forgery vulnerability
In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection...
sn-cicd (>=4.6.12, <=4.6.17) potentially affected by CVE-2023-52555 via mongo-express (1.0.0-alpha.1)
mongo-express NPM version 1.0.0-alpha.1 is affected by a known vulnerability. The following packages have a transitive dependency on mongo-express and may be impacted: - sn-cicd =4.6.12, =4.6.17 Source cves: CVE-2023-52555 Source advisory: OSV:GHSA-FFFG-CWC9-XVJ7...