NewStart CGSL MAIN 6.02 : sqlite Multiple Vulnerabilities (NS-SA-2022-0052)

The remote NewStart CGSL host, running version MAIN 6.02, has sqlite packages installed that are affected by multiple vulnerabilities: - SQLite through 3.32.0 has an integer overflow in sqlite3strvappendf in printf.c. CVE-2020-13434 - In SQLite before 3.32.3, select.c mishandles query-flattener...

GitLab 信息泄露漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Community Edition is a community edition of GitLab. An information disclosure vulnerability exists in Gitlab Community Edition versions...

jsgui-lang-essentials 安全漏洞

jsgui-lang-essentials is a small but powerful utility module for use with other jsgui modules. A security vulnerability exists in all versions of the jsgui-lang-essentials package, which stems from the fact that it allows all Object properties to be changed...

andalucianproperties.info Cross Site Scripting vulnerability OBB-2562152

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Google Android Security Bypass Vulnerability (CNVD-2022-32845)

Google Android is a Linux-based open source operating system from Google. Google Android has a security vulnerability that can be exploited by attackers to arbitrarily modify and set system properties...

Security Bulletin: Information disclosure for IBM Infosphere Global Name Management

Summary There is a potential information disclosure vulnerability in Global Name Management when using Enterprise Name Search. The information disclosure is due to an XML external entity XXE vulnerability. Customers not using Enterprise Name Search are not affected. Vulnerability Details CVEID:...

Security update for nodejs12 (moderate)

openSUSE Security Update: Security update for nodejs12 Announcement ID: openSUSE-SU-2022:0113-1 Rating: moderate References: 1194511 1194512 1194513 1194514 1198204 Cross-References: CVE-2021-44531 CVE-2021-44532 CVE-2021-44533 CVE-2022-21824 CVE-2022-24191 CVSS scores: CVE-2021-44531 NVD : 7.4...

The vulnerability of the software for managing virtual infrastructure, such as VMware vCenter Server and VMware Cloud Foundation, is related to deficiencies in access control. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the software for managing virtual infrastructure, such as VMware vCenter Server and VMware Cloud Foundation, is related to deficiencies in access control to the /etc/vmware-vpx/vcdb.properties file, which contains plaintext credentials. Exploiting this vulnerability could all...

CVE-2022-21803

A flaw was found in the nconf library when setting the configuration properties. This flaw allows an attacker to provide a crafted property, leading to prototype object pollution...

CVE-2022-21803

This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted...

Cross-site Scripting (XSS)

An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete...

CVE-2021-27493

Philips Vue PACS versions 12.2.x.x and prior does not ensure or incorrectly ensures structured messages or data are well formed and that certain security properties are met before being read from an upstream component or sent to a downstream component...

Design/Logic Flaw

Philips Vue PACS versions 12.2.x.x and prior does not ensure or incorrectly ensures structured messages or data are well formed and that certain security properties are met before being read from an upstream component or sent to a downstream component...

CVE-2021-39767

In miniadb, there is a possible way to get read/write access to recovery system properties due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

Design/Logic Flaw

In miniadb, there is a possible way to get read/write access to recovery system properties due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2022-28159

Jenkins Tests Selector Plugin 1.3.3 and earlier does not escape the Properties File Path option for Choosing Tests parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

PT-2022-18858 · Jenkins · Jenkins Tests Selector Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Tests Selector Plugin versions 1.3.3 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability. This occurs because the Properties File Path option for Choosing Tests parameters is not properly...

Prototype Pollution

simple-plist is vulnerable to prototype pollution. The vulnerability exists because the validations are not handled properly which allows an attacker to inject properties into existing construct prototypes and modify attributes via .parse function...

Cross-site Scripting (XSS)

showdoc/showdoc is vulnerable to cross-site scripting. An attacker can inject and execute malicious javascript through the .properties files...

showdoc .properties file upload vulnerability (CNVD-2022-20508)

showdoc is an open source tool for IT teams to share documents online. showdoc versions prior to v2.10.4 are vulnerable to file uploads, which stem from the lack of effective detection of .properties file extensions in the application's file upload feature. An attacker could use this vulnerabilit...