CVE-2019-25092

A vulnerability classified as problematic was found in Nakiami Mellivora up to 2.1.x. Affected by this vulnerability is the function printuseriplog of the file include/layout/user.inc.php of the component Admin Panel. The manipulation of the argument $entry'ip' leads to cross site scripting. The...

CVE-2019-25092: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic was found in Nakiami Mellivora up to 2.1.x. Affected by this vulnerability is the function printuseriplog of the file include/layout/user.inc.php of the component Admin Panel. The manipulation of the argument $entry'ip' leads to cross site scripting. The...

CVE-2022-46101

AyaCMS v3.1.2 was found to have a code flaw in the ustsql.inc.php file, which allows attackers to cause command execution by inserting malicious code...

CVE-2022-45942

A Remote Code Execution RCE vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4...

baijiacms 操作系统命令注入漏洞

baijiacms is a content management system CMS for e-commerce. A security vulnerability exists in the baijiacms version, which stems from a Remote Code Execution RCE vulnerability in includes/baijiacms/common.inc.php. No details of the vulnerability are available at this time...

GHSA-X3X3-QWJQ-8GJ4 Apache CXF Server-Side Request Forgery vulnerability

A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type...

PT-2022-27840

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 3.5.5 Apache CXF versions prior to 3.4.10 Description A Server-Side Request Forgery SSRF issue exists in the parsing of the href attribute of XOP:Include in MTOM requests. This allows an attacker to perform SSRF...

PT-2022-37986

Уязвимость функции pte user accessible page модуля arch/arm64/include/asm/pgtable.h поддержки платформы ARM 64бит ядра операционной системы Linux связана с копированием буфера без проверки размера входных данных классическое переполнение буфера. Эксплуатация уязвимости может позволить нарушителю...

PT-2022-38100

Уязвимость функции get wchan модуля arch/s390/include/asm/processor.h поддержки платформы S390 ядра операционной системы Linux связана с переполнением буфера на основе стека. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность, целостность и доступность...

libxml2: Incorrect server side include parsing can lead to XSS

A Cross-site scripting XSS vulnerability was found in libxml2. A specially crafted input, when serialized and re-parsed by the libxml2 library, will result in a document with element attributes that did not exist in the original document...

RLSA-2022:7715 Moderate: libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: Incorrect server side include parsing can lead to XSS CVE-2016-3709 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and oth...

PT-2022-37996

Уязвимость модуля include/uapi/linux/capability.h ядра операционной системы Linux связана с чтением за границами буфера. Эксплуатация уязвимости может позволить нарушителю получить доступ к защищаемой информации или вызвать отказ в обслуживании...

Authorization Bypass

Spring Security Web is vulnerable to Authorization Bypass. The vulnerability exists in AuthorizationFilter because it incorrectly extends OncePerRequestFilter which allows an attacker to bypass authorization rules via forward or include dispatcher types...

The vulnerability of the `include/chart_generator.php` script of the Pandora Console component, a monitoring and management system for IT environments in the Pandora FMS framework. This script allows attackers to bypass security restrictions and execute arbitrary SQL code.

The vulnerability of the include/chartgenerator.php implementation of the Pandora Console component in the Pandora FMS monitoring and management system is related to the lack of measures taken to protect the SQL query structure during the processing of the sessionid parameter. Exploiting this...

GHSA-MMMH-WCXM-2WR4 Spring Security authorization rules can be bypassed via forward or include dispatcher types

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies...

UBUNTU-CVE-2022-31692

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies...

CVE-2022-31692

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies...

Authorization rules can be bypassed via forward or include dispatcher types in Spring Security

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: An application is not vulnerable if any of the following i...

CVE-2022-31692: Authorization Bypass Through User-Controlled Key

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies...

The vulnerability of the Apache Struts software platform, related to improper code generation management, allows attackers to execute arbitrary code.

The vulnerability of the Apache Struts software framework is related to improper code generation during the processing of the includeParams attribute. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially crafted request...