8243 matches found
grafana security update
An update is available for grafana. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Grafana is an open source, feature rich metrics dashboard and graph editor fo...
CVE-2022-33977
untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service DoS condition on the server where the...
PYSEC-2022-243
untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service DoS condition on the server where the...
Important: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: grafana: OAuth account takeover CVE-2022-31107 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...
java-11-openjdk security, bug fix, and enhancement update
1:11.0.16.0.8-1.0.1 - Replace upstream references Orabug: 34340155 1:11.0.16.0.8-1 - Update to jdk-11.0.16+8 - Update release notes to 11.0.16+8 - Use same tarball naming style as java-17-openjdk and java-latest-openjdk - Drop JDK-8257794 patch now upstreamed - Print release file during build,...
CVE-2022-2209
DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage...
CVE-2022-2209
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage...
UBUNTU-CVE-2022-2209
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage...
Important: Red Hat Security Advisory: java-11-openjdk security update
An update for java-11-openjdk is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
IOTransfer 4.0 Remote Code Execution
Exploit Title: IOTransfer V4 – Remote Code Execution RCE Date: 06/22/2022 Exploit Author: Tomer Peled Vendor Homepage: https://www.iobit.com Software Link: https://iotransfer.itopvpn.com/ Version: V4 and onward Tested on: Windows 10 CVE : 2022-24562 References:...
CVE-2022-33944
The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs...
Design/Logic Flaw
The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs...
CVE-2022-33944
The CVE-2022-33944 case concerns MiCODUS MV720 GPS tracker’s web server, which is vulnerable to an authenticated insecure direct object reference (IDOR) on the endpoint and the POST parameter “Device ID,” allowing arbitrary device IDs to be supplied. This vulnerability is highlighted in the ICS a...
Atlassian Confluence < 7.4.17 / 7.5.x < 7.13.7 / 7.14.x < 7.14.3 / 7.15.x < 7.15.2 / 7.16.x < 7.16.4 / 7.17.x < 7.17.4 XSS (CONFSERVER-79476)
The version of Atlassian Confluence installed on the remote host is prior to 7.4.17 / 7.5.x 7.13.7 / 7.14.x 7.14.3 / 7.15.x 7.15.2 / 7.16.x 7.16.4 / 7.17.x 7.17.4. It is, therefore, affected by a vulnerability as referenced in the CONFSERVER-79476 advisory. - Multiple Servlet Filter vulnerabiliti...
Insecure Direct Object References when creating a list
Description Insecure direct object references when creating a list allows one user to create a new list on behalf of another. Proof of Concept POST /list HTTP/2 Host: bookwyrm.social Cookie: djangolanguage=None; csrftoken=I5lj4znBJ9B5HnT3FAsII67G1EISidIKGlsIz5ElN9kmlDwucM2hGKx0Fy4gM8vj;...
Shescape vulnerable to insufficient escaping of whitespace
Impact This only impacts users that use the escape or escapeAll functions with the interpolation option set to true. Example: javascript import cp from "node:childprocess"; import as shescape from "shescape"; // 1. Prerequisites const options = shell: "bash", // Or shell: "dash", // Or shell:...
GHSA-44VR-RWWJ-P88H Shescape vulnerable to insufficient escaping of whitespace
Impact This only impacts users that use the escape or escapeAll functions with the interpolation option set to true. Example: javascript import cp from "node:childprocess"; import as shescape from "shescape"; // 1. Prerequisites const options = shell: "bash", // Or shell: "dash", // Or shell:...
GHSA-QWRJ-9HMP-GPXH FlyteAdmin Insufficient AccessToken Expiration Check
Impact Authenticated users using an external identity provider can continue to use Access Tokens and ID Tokens even after they expire. Using flyteadmin as the OAuth2 Authorization Server is unaffected by this issue. Patches 1.1.30 Workarounds Rotating signing keys immediately will: Invalidate all...
Insecure direct object references in "review" function
Description Insecure direct object references in review a book function allows one user to create a comment on behalf of another. Proof of Concept POST /post/review HTTP/2 Host: book.dansmonorage.blue Cookie: csrftoken=bYsdqkQkkbYXZYRVd8AynhYxG1rBb2AoOfAO76XCYmgzXK3A266EpZamGcKL0pN5;...
Octopus Server 安全漏洞
Octopus Server is an automated deployment platform. Octopus Server has a security vulnerability that stems from the presence of insecure object references, which can be exploited by an attacker to download projects and export them from projects to which they do not have access...