4131 matches found
[SECURITY] Fedora 35 Update: golang-github-cloudflare-redoctober-0-0.9.20210114git99c99a8.fc35
Red October is a software-based two-man rule style encryption and decryption server...
October CMS Competitive Conditions Issue Vulnerability
October CMS is an open source content management system CMS based on PHP and Laravel web application framework. October CMS suffers from a Competing Conditions Issue vulnerability. The vulnerability stems from improper handling of concurrent access when concurrent code requires mutually exclusive...
GHSA-8V7H-CPC2-R8JP October CMS upload process vulnerable to RCE via Race Condition
Impact This advisory affects plugins that expose the October\Rain\Database\Attach\File::fromData as a public interface. This vulnerability does not affect vanilla installations of October CMS since this method is not exposed or used by the system internally or externally. When the developer allow...
October CMS upload process vulnerable to RCE via Race Condition
Impact This advisory affects plugins that expose the October\Rain\Database\Attach\File::fromData as a public interface. This vulnerability does not affect vanilla installations of October CMS since this method is not exposed or used by the system internally or externally. When the developer allow...
CVE-2022-24800
October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2.15, when the developer allows the user to specify their own filename in the fromData method, an unauthenticated user can perform remote co...
Race condition
October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2.15, when the developer allows the user to specify their own filename in the fromData method, an unauthenticated user can perform remote co...
CVE-2022-24800 Race Condition in October CMS upload process
October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2.15, when the developer allows the user to specify their own filename in the fromData method, an unauthenticated user can perform remote co...
CVE-2022-24800
CVE-2022-24800 describes a race-condition vulnerability in the October CMS upload process. If a plugin exposes the public method October\Rain\Database\Attach\File::fromData and a user can supply a filename, an unauthenticated attacker can achieve remote code execution by racing in the temporary ...
CVE-2022-24800 Race Condition in October CMS upload process
October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2.15, when the developer allows the user to specify their own filename in the fromData method, an unauthenticated user can perform remote co...
CVE-2022-24800 Race Condition in October CMS upload process
October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2.15, when the developer allows the user to specify their own filename in the fromData method, an unauthenticated user can perform remote co...
October CMS 竞争条件问题漏洞
October CMS is an open source content management system CMS based on PHP and Laravel web application framework. October CMS suffers from a Competing Conditions Issue vulnerability. The vulnerability stems from improper handling of concurrent access when concurrent code requires mutually exclusive...
[SECURITY] Fedora 36 Update: golang-github-cloudflare-redoctober-0-0.12.20210114git99c99a8.fc36
Red October is a software-based two-man rule style encryption and decryption server...
rosss.com Cross Site Scripting vulnerability OBB-2705088
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Security Bulletin: IBM SDK, Java Technology Edition, Security Update October 2021
Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, 8 that are used by Rational Application Developer®. These issues were disclosed as part of the IBM Java SDK updates in October 2021. IBM 8 Fix SR7 FP5 8.0.7.5. Vulnerability Details CVEID: CVE-2022-21365 DESCRIPTION:...
Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Oct 2021 - Includes Oracle October 2021 CPU
Summary Multiple vulnerabilities has been identified in IBM Java. IBM SDK, Java Technology Edition Quarterly CPU - Oct 2021 - Includes Oracle October 2021 CPU Copy Services Manager has a dependency on Java. Version CSM 6.3.1 and prior are therefore exposed by this vulnerability. CSM 6.3.2 ships a...
Security Updates for Microsoft Excel Products C2R (October 2021)
The Microsoft Excel Products are missing security updates. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2021-40474, CVE-2021-40485 - An...
Security Bulletin: The IBM® SDK Java Technology Edition, October 2021 CPU affect IBM Common Licensing (CVE-2021-35560, CVE-2021-35586, CVE-2021-35578, CVE-2021-35564, CVE-2021-35559, CVE-2021-35556, CVE-2021-35565, CVE-2021-35588, CVE-2021-41035)
Summary There are multiple security vulnerabilities that are addressed in the IBM® SDK Java Technology Edition, October 2021 CPU, found in the IBM® Runtime Environment Java™ used by IBM License Key Server Administration and Reporting Tool and its Agent. Vulnerability Details Refer to the security...
CVE-2021-42859
A memory leak issue was discovered in Mini-XML v3.2 that could cause a denial of service. NOTE: testing reports are inconsistent, with some testers seeing the issue in both the 3.2 release and in the October 2021 development code, but others not seeing the issue in the 3.2 release...
UBUNTU-CVE-2021-42859
DISPUTED A memory leak issue was discovered in Mini-XML v3.2 that could cause a denial of service. NOTE: testing reports are inconsistent, with some testers seeing the issue in both the 3.2 release and in the October 2021 development code, but others not seeing the issue in the 3.2 release...
GHSA-9HQ8-V2JC-QJ4R October CMS XSS In Caption Tag of Profile
Cross-site scripting XSS vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption tag of a profile image...