glibc 安全漏洞

glibc GNU C Library is the C standard library implemented by the GNU Project. A security vulnerability exists in the GNU C Library also known as glibc, which stems from the use of the deprecated compatibility function svcunix create in the sunrpc module to copy its path parameter onto the stack...

PT-2022-1557

Name of the Vulnerable Software and Affected Versions D-Link device DI-7200GV2.E1 version 21.04.09E1 Description The issue is related to a command injection vulnerability in the version upgrade.asp function. This vulnerability allows attackers to execute arbitrary commands via the path parameter...

resteasy: Error message exposes endpoint class information

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The...

CVE-2021-26615

ARK library allows attackers to execute remote code via the parameterpath value of ArkNormalizeAndDupPAthNameW function because of an integer overflow...

CVE-2021-26615

ARK library allows attackers to execute remote code via the parameterpath value of ArkNormalizeAndDupPAthNameW function because of an integer overflow...

resteasy: Error message exposes endpoint class information

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The...

CVE-2021-32482

Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter...

Design/Logic Flaw

Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter...

CVE-2021-32482

Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter...

CVE-2021-32482

CVE-2021-32482 affects Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x. Multiple connected sources describe a Cross‑Site Scripting (XSS) vulnerability exploitable via a path parameter. The root cause is an XSS condition in the path handling of Cloudera Manager; explicit exploit details, affect...

CVE-2021-32482

Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter...

PT-2021-19721

Name of the Vulnerable Software and Affected Versions: Cloudera Manager versions 5.x through 7.3.x Description: The issue allows for a cross-site scripting XSS attack via the path parameter. This means an attacker could potentially inject malicious scripts into the website, affecting users who...

CVE-2021-32482: Improper Neutralization of Input During Web Page Generation

Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter...

CVE-2021-33800

In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal...

CVE-2021-33800

In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal...

CVE-2021-23624

This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter are arrays...

Type confusion

This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter are arrays...

CVE-2021-23624

This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter are arrays...

PT-2021-15540

Name of the Vulnerable Software and Affected Versions dotty versions prior to 0.1.2 Description A type confusion issue can lead to a bypass when user-provided keys used in the path parameter are arrays. Recommendations For versions prior to 0.1.2, update to version 0.1.2 or later to resolve the...

CVE-2021-23624: Access of Resource Using Incompatible Type

This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter are arrays...