229 matches found
CVE-2022-43770: Incorrect Authorization
Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.4 and 8.3.0.27 does not correctly perform an authorization check in the dashboard editor plugin API...
SUSE CVE-2011-2996
Unspecified vulnerability in the plugin API in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via unknown vectors...
SUSE CVE-2013-2912
Use-after-free vulnerability in the PepperInProcessRouter::SendToHost function in content/renderer/pepper/pepperinprocessrouter.cc in the Pepper Plug-in API PPAPI in Google Chrome before 30.0.1599.66 allows remote attackers to cause a denial of service or possibly have unspecified other impact vi...
CVE-2022-41255
Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...
USN-5182-1 roundcube vulnerabilities
It was discovered that Roundcube Webmail allowed JavaScript code to be present in the CDATA of an HTML message. A remote attacker could possibly use this issue to execute a cross-site scripting XSS attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM...
The vulnerability of the Apache ShenYu software lies in the lack of authorization for critical functions, which allows attackers to circumvent established security restrictions.
The vulnerability of the Apache ShenYu software lies in the lack of authorization for critical functions. Exploiting this vulnerability allows a malicious actor to bypass established security restrictions and gain access to the /plugin API without being authorized...
GHSA-6V39-P2XQ-G5C3 Missing authentication in ShenYu
User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1...
Insecure Access Control
shenyu has insecure access control. The vulnerability exists due to a lack of validation of the user access via the /plugin api allowing an attacker to access the system without authentication...
CVE-2022-23944
User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1...
Authentication flaw
User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1...
CVE-2022-23944
User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1...
PT-2022-1759
Name of the Vulnerable Software and Affected Versions Apache ShenYu versions 2.4.0 through 2.4.1 Description The issue is related to the lack of authentication for a critical function, allowing a remote attacker to bypass security restrictions and access the "/plugin API" endpoint without...
CVE-2022-23944: Missing Authorization
User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1...
[SECURITY] Fedora 33 Update: nbdkit-1.24.6-1.fc33
NBD is a protocol for accessing block devices hard disks and disk-like things over the network. nbdkit is a toolkit for creating NBD servers. The key features are: Multithreaded NBD server written in C with good performance. Minimal dependencies for the basic server. Liberal license BSD allows...
[SECURITY] Fedora 34 Update: nbdkit-1.26.5-1.fc34
NBD is a protocol for accessing block devices hard disks and disk-like things over the network. nbdkit is a toolkit for creating NBD servers. The key features are: Multithreaded NBD server written in C with good performance. Minimal dependencies for the basic server. Liberal license BSD allows...
[SECURITY] Fedora 33 Update: tcmu-runner-1.5.2-7.fc33
A daemon that handles the complexity of the LIO kernel target's userspace passthrough interface TCMU. It presents a C plugin API for extension modu les that handle SCSI requests in ways not possible or suitable to be handled by LIO's in-kernel backstores...
DEBIAN-CVE-2020-16014
Use after free in PPAPI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page...
UBUNTU-CVE-2020-16014
Use after free in PPAPI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page...
The vulnerability of the PPAPI implementation in the Google Chrome web browser allows a hacker to execute arbitrary code.
The vulnerability of the PPAPI implementation in the Google Chrome web browser relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
