2365 matches found
ingress-nginx path sanitization can be bypassed
Issue Details A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use directives to bypass the sanitization of the spec.rules.http.paths.path field of an Ingress object in the networking.k8s.io or extensions API group to obtain the credentia...
CVE-2023-46115 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli
Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...
Android Security Bulletin—October 2023Stay organized with collectionsSave and categorize content based on your preferences.
The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2023-10-06 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...
Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client
Impact Improper input validation in the init function allows arbitrary javascript to be executed using the javascript: prefix ts SSO.init'javascript:alert"javascript successfully injected"' Patches This vulnerability was patched on version 0.1.0 Workarounds This vulnerability can be prevented if...
GHSA-VP4F-WXGW-7X8X Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client
Impact Improper input validation in the init function allows arbitrary javascript to be executed using the javascript: prefix ts SSO.init'javascript:alert"javascript successfully injected"' Patches This vulnerability was patched on version 0.1.0 Workarounds This vulnerability can be prevented if...
DEBIAN-CVE-2023-37369
In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length...
In Qt before 5.15.15 6.x before 6.2.9 and 6.3.x through 6.5.x before 6.5.2 there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length.
...
CVE-2023-37369
In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length...
ASB-A-264880895
In update of MmsProvider.java, there is a possible way to change directory permissions due to a path traversal error. This could lead to local denial of service of SIM recognition with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2023-34235 Leaking sensitive user information still possible by filtering on private with prefix fields
Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the tnumber prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to...
Leaking sensitive user information still possible by filtering on private with prefix fields
Summary Still able to leak private fields if using the tnumber prefix Details Knex query allows you to change there default prefix SqliteError: select distinct t0. from pages as t0 left join adminusers as t1 on t0.updatedbyid = t1.id where t1.password = 1 so if you change the prefix to the same a...
Strapi 信息泄露漏洞
Strapi is an open source content management system CMS. An information disclosure vulnerability exists in Strapi versions prior to 4.10.8, which stems from a Knex query that allows a user to change the default prefix, which may disclose private fields if the tnumber prefix is used...
PT-2023-24759
Name of the Vulnerable Software and Affected Versions Strapi versions prior to 4.10.8 Description The issue allows for the leakage of private fields when using the tnumber prefix. This is possible because the Knex query allows users to change the default prefix. For example, changing the prefix t...
CVE-2023-37189
A stored cross site scripting XSS vulnerability in index.php?menu=billingrates of Issabel PBX version 4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Name or Prefix fields under the Create New Rate module...
CVE-2023-37189
A stored cross site scripting XSS vulnerability in index.php?menu=billingrates of Issabel PBX version 4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Name or Prefix fields under the Create New Rate module...
Cross site scripting
A stored cross site scripting XSS vulnerability in index.php?menu=billingrates of Issabel PBX version 4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Name or Prefix fields under the Create New Rate module...
Issabel PBX 跨站脚本漏洞
Issabel PBX is a software application. A free and open source software that allows you to build communication tools for your organization. A cross-site scripting vulnerability exists in Issabel PBX version v.4.0.0-6, which originates from a vulnerability that allows attackers to execute arbitrary...
CVE-2023-2232
An issue has been discovered in GitLab affecting all versions starting from 15.10 before 16.1, leading to a ReDoS vulnerability in the Jira prefix...