9998 matches found
GHSA-H755-8QP9-CQ85 protobufjs Prototype Pollution vulnerability
protobuf.js aka protobufjs 6.10.0 until 6.11.4 and 7.0.0 until 7.2.4 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and...
CVE-2023-36665
"protobuf.js aka protobufjs 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions...
CVE-2023-36665
"protobuf.js aka protobufjs 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions...
Active Health Check strategies with Spring Cloud Gateway
Active health check strategies with Spring Cloud Gateway Nowadays, applications are built as a collection of small independent upstream services. This accelerates development and allows modules to be focused on specific responsibilities, increasing their quality. This is one of the main advantage...
PT-2023-25667
Name of the Vulnerable Software and Affected Versions protobuf.js versions 6.10.0 through 7.2.4 Description The issue allows Prototype Pollution, where a user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and...
CVE-2023-36665
"protobuf.js aka protobufjs 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions...
User Activity Log < 1.6.3 - Admin+ SQL Injection
The plugin does not properly sanitise and escape the txtsearch parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin. As an admin, visit either of the following URL's. Note that it takes several seconds for t...
Virtuozzo Hybrid Infrastructure 5.4 Update 3 (5.4.3-100)
In this release, Virtuozzo Hybrid Infrastructure provides a range of new features that cover core storage, the system configuration, updates, documentation, and the compute services. Additionally, this release delivers stability improvements and addresses issues found in previous releases...
CVE-2021-4384
The WordPress Photo Gallery – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the loadimagesthumbnail and editgallery functions. This makes it possible for unauthenticat...
CVE-2020-36739
The Feed Them Social – Page, Post, Video, and Photo Galleries plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.6. This is due to missing or incorrect nonce validation on the myftsfbloadmore function. This makes it possible for unauthenticated...
WordPress Plugin Feed Them Social – Page, Post, Video, and Photo Galleries 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin.... A cross-site request forgery...
PT-2023-11879 · WordPress · Feed Them Social
Name of the Vulnerable Software and Affected Versions: Feed Them Social – Page, Post, Video, and Photo Galleries plugin for WordPress versions up to, and including, 2.8.6 Description: The issue is due to missing or incorrect nonce validation on the my fts fb load more function, making it possible...
[SECURITY] Fedora 37 Update: bind-dyndb-ldap-11.10-15.fc37
This package provides an LDAP back-end plug-in for BIND. It features support for dynamic updates and internal caching, to lift the load off of your LDAP server...
PT-2023-18008 · Google · Android Kernel
Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a possible out of bounds write in the load dt data function of storage.c due to a missing bounds check. This could lead to local escalation of privilege, requiring System execution privilege...
How to Block HTTP TRACE Method by Using Responder Policy
This article describes how to use responder policy to block http trace method when clients access origin web servers behind lb virtual server...
Fedora: Security Advisory for trafficserver (FEDORA-2023-92686b3e8b)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Supsystic Popup < 1.10.19 - Prototype Pollution
The plugin has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype. 1 Create a pop-up that is set to load on any page 2 Go to http://example.com/?protopoc=polluted 3 Open browser console 4 Type poc and see polluted as the result...
GHSA-6643-H7H5-X9WH Langchain vulnerable to arbitrary code execution
Langchain 0.0.171 is vulnerable to Arbitrary code execution in loadprompt...
