5135 matches found
CVE-2017-20166
Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between isnil and raise...
CVE-2017-20166
CVE-2017-20166 affects Ecto 2.2.0, describing a lack of a protection mechanism in the interaction between is_nil and raise. The surrounding entries (NVD, Red Hat, OSV, GHSA duplicates, CNNVD, CVE records) consistently reference this issue with Ecto 2.2.0 and do not provide concrete exploit detail...
Description of the security update for Excel 2016: January 10, 2023 (KB5002322)
None None...
AlmaLinux 8 : grub2 (ALSA-2023:0049)
The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:0049 advisory. - A buffer overflow was found in grubfontconstructglyph. A malicious crafted pf2 font can lead to an overflow when calculating the maxglyphsize value,...
RHEL 8 : grub2 (RHSA-2023:0047)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0047 advisory. The grub2 packages provide version 2 of the Grand Unified Boot Loader GRUB, a highly configurable and customizable boot loader with modular...
Red Hat Keycloak 授权问题漏洞
Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak that stems from an improperly implemented behavioral workflow that allows an attacker to...
CVE-2021-41823
The Web Application Firewall WAF in Kemp LoadMaster 7.2.54.1 allows certain uses of onmouseover to bypass an XSS protection mechanism...
Server side request forgery (ssrf)
OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record...
CVE-2022-37313
OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record...
CVE-2022-43551
A vulnerability exists in curl 7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypasse...
NFT owner only is allowed for liquidation, this may not work for all the cases, the debt can be insolvent
Lines of code Vulnerability details Impact When bad debt is not paid or not able to recover the through auction of NFT, then the debt will be insolvent. Proof of Concept Contract allows for liquidation to recover the debt. Also, it has the auctioning mechanism to recover the debt by selling the...
Fedora 35 : grub2 (2022-7ce9378e90)
The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-7ce9378e90 advisory. - put the font back in /boot for now Yes, this bloats size by a couple meg. Hopefully this won't cause problems for anyone and everyone can be okay...
Microsoft Details Gatekeeper Bypass Vulnerability in Apple macOS Systems
Microsoft has disclosed details of a now-patched security flaw in Apple macOS that could be exploited by an attacker to get around security protections imposed to prevent the execution of malicious applications. The shortcoming, dubbed Achilles CVE-2022-42821, CVSS score: 5.5, was addressed by th...
Cron execution command field allows attackers with admin privilege to execute OS command as root
Description - Cron execution command value is written into cronfile without any security protection mechanism. - If an attacker gained admin access, he/she can run OS command as root. Proof of Concept 1/ Navigate to http://webserver/froxlor/adminsettings.php?page=overview&part=crond 2/ In the Cro...
MGASA-2022-0473 Updated golang packages fix security vulnerability
net/http: limit canonical header cache by bytes, not entries bsc1206135 CVE-2022-41717...
Arbitrary Code Execution
replicator is vulnerable to untrusted data deserialization. The vulnerability exists in the fromSerializable function in TypedArray object which allows a remote attacker to run arbitrary code due to an improper deserialization mechanism...
CVE-2022-2601
A buffer overflow was found in grubfontconstructglyph. A malicious crafted pf2 font can lead to an overflow when calculating the maxglyphsize value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may...
CVE-2022-2601
A buffer overflow was found in grubfontconstructglyph. A malicious crafted pf2 font can lead to an overflow when calculating the maxglyphsize value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may...
CVE-2022-23499
HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. In versions prior to 1.5.0 or 2.1.1, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized due to a parsing issue in the...