6788 matches found
TYPO3 Flow Cross-site scripting (XSS) vulnerability
Cross-site scripting XSS vulnerability in the errorAction method in the ActionController base class in TYPO3 Flow formerly FLOW3 1.1.x before 1.1.1 and 2.0.x before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message...
GHSA-VC74-C4M6-9979 TYPO3 Flow Cross-site scripting (XSS) vulnerability
Cross-site scripting XSS vulnerability in the errorAction method in the ActionController base class in TYPO3 Flow formerly FLOW3 1.1.x before 1.1.1 and 2.0.x before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message...
ColumnPack:ColumnPack-plugin (=1.0.3), CustomHistory:CustomHistory (>=1.1 <=1.3) +698 more potentially affected by CVE-2012-6072 via org.jenkins-ci.main:jenkins-core (>=1.396 <=1.480)
org.jenkins-ci.main:jenkins-core MAVEN version =1.396, =1.1, =0.9, =1.0, =1.0, =1.0-beta-1, =2.1, =1.0, =1.0, =0.1, =0.1, =0.17 and more Source cves: CVE-2012-6072 Source advisory: SNYK:JAVA-ORGJENKINSCIMAIN-9404603...
at.ac.ait.lablink.clients:csvclient (>=0.0.1 <=0.0.2), at.ac.ait.lablink.clients:dpbridge (>=0.0.1 <=0.0.3) +302 more potentially affected by CVE-2013-2027 via org.python:jython-standalone (>=2.5.2 <=2.7.2)
org.python:jython-standalone MAVEN version =2.5.2, =0.0.1, =0.0.1, =0.0.1, =0.0.2, =0.0.2, =0.0.1, =0.0.1, =0.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.0.0, =1.0.0, =1.3.0, =2.1.2 and more Source cves: CVE-2013-2027 Source advisory: OSV:GHSA-9347-9W64-Q5WP...
CVE-2022-22252
The DFX module has a UAF vulnerability.Successful exploitation of this vulnerability may affect system stability...
Process_Overwriting - Yet Another Variant Of Process Hollowing
Process Overwriting is a PE injection technique, closely related to Process Hollowing and Module Overloading Process Hollowing aka RunPE is an old and popular PE injection technique. It comes in has variety of flavors, but there are some steps in common: 1. Start by creating a process in a...
ChakraCore Security Bypass
A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard CFG to be bypassed, aka "Scripting Engine Security Feature Bypass Vulnerability." This affects Microsoft Edge, ChakraCore...
GHSA-FV8M-P45W-GF38 ChakraCore RCE Vulnerability
Microsoft ChakraCore allows an attacker to bypass Control Flow Guard CFG in conjunction with another vulnerability to run arbitrary code on a target system, due to how the Chakra scripting engine handles accessing memory, aka "Scripting Engine Security Feature Bypass"...
ChakraCore RCE Vulnerability
Microsoft ChakraCore allows an attacker to bypass Control Flow Guard CFG in conjunction with another vulnerability to run arbitrary code on a target system, due to how the Chakra scripting engine handles accessing memory, aka "Scripting Engine Security Feature Bypass"...
GHSA-Q4V9-QJMW-J7VF Insecure Default Initialization of Resource in Pivotal Spring Web Flow
An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default i.e., set to 'false' can be vulnerable to malicious EL expressions in view states that process form...
Insecure Default Initialization of Resource in Pivotal Spring Web Flow
An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default i.e., set to 'false' can be vulnerable to malicious EL expressions in view states that process form...
GHSA-FG9W-CFFM-PMH2 Insecure Default Initialization of Resource in Pivotal Spring Web Flow
An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default i.e., set to 'false' can be vulnerable to malicious EL expressions in view states that process form...
Insecure Default Initialization of Resource in Pivotal Spring Web Flow
An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default i.e., set to 'false' can be vulnerable to malicious EL expressions in view states that process form...
org.jenkins-ci.plugins:vectorcast-execution (>=0.16 <=0.61), org.zeroturnaround.jenkins:build-flow-test-aggregator (>=1.1 <=1.2) potentially affected by CVE-2017-1000390 via org.jenkins-ci.plugins:jenkins-multijob-plugin (>=1.16 <=1.21)
org.jenkins-ci.plugins:jenkins-multijob-plugin MAVEN version =1.16, =0.16, =1.1, =1.2 Source cves: CVE-2017-1000390 Source advisory: OSV:GHSA-P9R2-GGHQ-HC57...
CVE-2021-27768
Using the ability to perform a Man-in-the-Middle MITM attack, which indicates a lack of hostname verification, sensitive account information was able to be intercepted. In this specific scenario, the application's network traffic was intercepted using a proxy server set up in 'transparent' mode...
CVE-2022-21128
Insufficient control flow management in the IntelR Advisor software before version 7.6.0.37 may allow an authenticated user to potentially enable escalation of privilege via local access...
CVE-2021-33122
Insufficient control flow management in the BIOS firmware for some IntelR Processors may allow a privileged user to potentially enable aescalation of privilege via local access...
CVE-2021-33077
Insufficient control flow management in firmware for some IntelR SSD, IntelR OptaneTM SSD and IntelR SSD DC Products may allow an unauthenticated user to potentially enable escalation of privilege via physical access...
CVE-2021-33077
Insufficient control flow management in firmware for some IntelR SSD, IntelR OptaneTM SSD and IntelR SSD DC Products may allow an unauthenticated user to potentially enable escalation of privilege via physical access...
