4800 matches found
WordPress XSS Vulnerability (May 2020) - Windows
WordPress is prone to a cross-site scripting vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress";...
GHSA-H4RC-386G-6M85 vulnerabilities
Vulnerabilities for packages: hive...
CVE-2020-11008
Technical details for CVE-2020-11008 are not present in the provided connected documents. The sources discuss related CVEs and general Git credential leakage vectors but do not specify affected versions, root cause, fixes, or exploitation status for this CVE. Monitor for updates.
Remote Code Execution (RCE) vulnerability in dropwizard-validation
Summary A server-side template injection was identified in the self-validating @SelfValidating feature of dropwizard-validation enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution RCE vulnerability. If you're using a self-validating bean via @SelfValidatin...
GHSA-JXFH-8WGV-VFR2 vulnerabilities
Vulnerabilities for packages: mysql...
GHSA-PCQQ-5962-HVCW Denial of Service in uap-core when processing crafted User-Agent strings
Impact Some regexes are vulnerable to regular expression denial of service REDoS due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTPS request to maliciously crafted long strings. Patches Please update uap-ruby to = v2.6....
Denial of Service in uap-core when processing crafted User-Agent strings
Impact Some regexes are vulnerable to regular expression denial of service REDoS due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTPS request to maliciously crafted long strings. Patches Please update uap-ruby to = v2.6....
GHSA-H4MF-75HF-67W4
creationtimestamp| type| source ---|---|--- 2020-03-06 09:48:23+00:00| seen| https://t.me/canyoupwnme/6311 2022-12-11 18:39:53+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/745...
HTTP Response Splitting in Styx
Vulnerability Styx is vulnerable to CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting'. Vulnerable Component The vulnerable component is the com.hotels.styx.api.HttpHeaders.Builder due to disabling the HTTP Header validation built into Netty in these...
Fedora 30 : golang-github-gorilla-websocket (2020-8f18c45545)
Update to latest version. Fix GHSA-jf24-p9p9-4rjh. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues....
Fedora 31 : golang-github-gorilla-websocket (2020-0ae6297680)
Update to latest version. Fix GHSA-jf24-p9p9-4rjh. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues....
GHSA-MXHP-79QH-MCX6 vulnerabilities
Vulnerabilities for packages: kubeflow-centraldashboard...
GHSA-R6J9-8759-G62W vulnerabilities
Vulnerabilities for packages: hadoop-fips...
GHSA-H822-R4R5-V8JG vulnerabilities
Vulnerabilities for packages: mysql...
Prototype Pollution
Overview Affected versions of mithrilare vulnerable to prototype pollution. The function parseQueryString may allow a malicious user to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects. A payload such as...
GHSA-VX85-MJ8C-4QM6 vulnerabilities
Vulnerabilities for packages: trino, druid...
GHSA-9MXF-G3X6-WV74 vulnerabilities
Vulnerabilities for packages: hive...
Moderate severity vulnerability that affects org.keycloak:keycloak-core
Withdrawn: Duplicate of CVE-2017-12161 / GHSA-959q-32g8-vvp7...
Arbitrary JavaScript Execution
Overview A vulnerability exists in bassmaster = 1.5.1 that allows for an attacker to provide arbitrary JavaScript that is then executed server side via eval. Recommendation Update to bassmaster version 1.5.2 or greater. References - Commit b751602 - GitHub Advisory...