714 matches found
Design/Logic Flaw
Ampere Altra and Ampere Altra Max devices through 2022-07-15 allow attacks via Hertzbleed, which is a power side-channel attack that extracts secret information from the CPU by correlating the power consumption with data being processed on the system...
CVE-2022-35888: Observable Discrepancy
Ampere Altra and Ampere Altra Max devices through 2022-07-15 allow attacks via Hertzbleed, which is a power side-channel attack that extracts secret information from the CPU by correlating the power consumption with data being processed on the system...
Squid Buffer Overflow Vulnerability (SQUID-2022:2)
Squid is prone to a buffer overflow vulnerability in SSPI and SMB authentication. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progr...
Apache Airflow vulnerable to Use of Externally-Controlled Format String
In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction...
GHSA-5RP4-749P-VX26 Apache Airflow vulnerable to Use of Externally-Controlled Format String
In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction...
Internet Bug Bounty: CVE-2022-40604: Apache Airflow: Format String Vulnerability
There is a format string vulnerability in Apache Airflow versions 2.3.0 through 2.3.4 in the src/airflow/utils/log/filetaskhandler.py file. The vulnerability was caused by unnecessary formatting of a URL, which could allow for information extraction...
CVE-2022-40604
In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction...
PYSEC-2022-279
In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction...
CVE-2022-40604
In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction...
CVE-2022-40604 Format String Vulnerability
In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction...
CVE-2022-40604 Format String Vulnerability
In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction...
CVE-2022-40604
CVE-2022-40604 affects Apache Airflow 2.3.0–2.3.4. A component of a URL was unnecessarily formatted, enabling information disclosure from a formatted URL. Multiple sources (NVD, OSV entries, and third‑party advisories) corroborate a format-string/vulnerability in the URL handling path (notably in...
CVE-2022-40604 Format String Vulnerability
In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction...
CVE-2022-40604: Use of Externally-Controlled Format String
In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction...
CVE-2022-38069: Use of Hard-coded Credentials
Multiple globally default credentials exist across all CMS8000 devices, that once exposed, allow a threat actor with momentary physical access to gain privileged access to any device. Privileged credential access enables the extraction of sensitive patient information or modification of device...
CVE-2022-26390 Unencrypted internal storage of security credentials
The Baxter Spectrum Wireless Battery Module WBM stores network credentials and PHI only applicable to Spectrum IQ pumps using auto programming in unencrypted form. An attacker with physical access to a device that hasn't had all data and settings erased may be able to extract sensitive informatio...
Security Bulletin: Vulnerability in REST API affects IBM License Metric Tool and IBM Endpoint Manager for Software Use Analysis (CVE-2015-4929)
Summary Vulnerability in REST API present in IBM License Metric Tool and IBM Endpoint Manager for Software Use Analysis allows for extraction of information. Vulnerability Details CVEID: CVE-2015-4929 DESCRIPTION: IBM License Metric Tool could allow an authenticated attacker to extract sensitive...
CVE-2022-24691: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A SQL Injection vulnerability allows authenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of SQL Injection is blind boolean based...
Design/Logic Flaw
A vulnerability has been identified in Mendix Applications using Mendix 7 All versions V7.23.27, Mendix Applications using Mendix 8 All versions V8.18.14, Mendix Applications using Mendix 9 All versions V9.12.0, Mendix Applications using Mendix 9 V9.6 All versions V9.6.3. When querying the...