999 matches found
GHSA-QJ9P-JVMW-82RH Apache Pinot has Groovy Function support enabled by default
Pinot allows you to run any function using Apache Groovy scripts. In versions prior to 0.10.0, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to groovy function support being enabled by default. This issue has been fixed by making function...
CVE-2022-26112 Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support
In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See...
CVE-2022-26112 Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support
In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See...
Trend Micro Apex One Security Agent Link Following Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within...
Emerson Proficy Machine Edition 数据伪造问题漏洞
Emerson Proficy Machine Edition is an application from Emerson, Inc. an automation solution. A data forgery issue vulnerability exists in Emerson Proficy Machine Edition version 9.00 and prior versions, which stems from the lack of authentication or authorization of packets after a connection is...
Trend Micro Apex One Security Agent Link Following Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within...
realtimesignage.de Cross Site Scripting vulnerability OBB-2707812
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
user can get document content even after removed
Description Admin can add a member to his personal collection .But if admin removed that user from this collection then that user still can see realtime document update content. Proof of Concept 1. From admin account invite user-B as member role .\ \ 2. From admin account create a private...
PHP Library Remote Code Execution Vulnerability
Several PHP compatibility libraries contain a potential remote code execution flaw in their jsondecode function based on having copy pasted existing vulnerable code. Affected components include the WassUp Realtime analytics WordPress plugin, AjaXplorer Core, and more. JAHx221 - RCE in copy/pasted...
MAL-2022-7176 Malicious code in wix-realtime-backend (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8234b124b5133dd9e6e23a2b6eafab2206f7b3dc67f99ba3f6ba1ef72012cc1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in wix-realtime-backend (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8234b124b5133dd9e6e23a2b6eafab2206f7b3dc67f99ba3f6ba1ef72012cc1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-2969 Malicious code in fastly-realtime-stats-prod (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69eac7a2e83ec3170454072cd78940a80689a9f2708167da078fb45c179996c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in fastly-realtime-stats-prod (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69eac7a2e83ec3170454072cd78940a80689a9f2708167da078fb45c179996c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5707 Malicious code in realtime-react (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53389921842257e5cac4021b62a872f18768a7c49183c56d80628379e3b4f52d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in realtime-react (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53389921842257e5cac4021b62a872f18768a7c49183c56d80628379e3b4f52d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in realtime-react-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23f7e46aae6bb6a92a21f6a3f023b7c4313db320cf9a5a382cb339c11f62bd29 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
[SECURITY] Fedora 35 Update: plib-1.8.5-30.fc35
This is a set of OpenSource LGPL libraries that will permit programmers to write games and other realtime interactive applications that are 100% portable across a wide range of hardware and operating systems. Here is what you need - it's all free and available with LGPL'ed source code on the web...
GHSA-M6PR-XCRM-4QQP XSS in Ignite Realtime Openfire via isTrustStore
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents...
XSS in Ignite Realtime Openfire via isTrustStore
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents...
GHSA-H2MQ-P9R5-WH94 Ignite Realtime Openfire allows Cross-site Scripting
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter. This issue was fixed in version 4.4.2...