xorg-x11-server: X.Org Server ProcXkbSetGeometry out-of-bounds access

A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the ProcXkbSetGeometry function due to improper validation of the request length...

The vulnerability of the library for working with SVG images in Apache Batik, related to insufficient validation of incoming requests, allows a hacker to execute arbitrary Java code.

The vulnerability of the Apache Batik library for working with SVG images is related to insufficient validation of incoming requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary Java code remotely...

ipTIME NAS 跨站请求伪造漏洞

ipTIME NAS is a wireless router product from South Korea's ipTIME Corporation that provides NAS network attached storage. A security vulnerability exists in ipTIME NAS that stems from a lack of validation of POST requests sent to a page. An attacker can exploit this vulnerability to delete user...

The vulnerability of the Build Handler component of the Jenkins Git plugin allows a perpetrator to perform arbitrary actions on a vulnerable device.

The vulnerability of the Build Handler component in the Jenkins Git plugin is related to insufficient validation of the authenticity of executed requests. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable device by manipulating the requests made...

The vulnerability of the mechanism for checking tokens on the Apache Struts software platform allows a perpetrator to carry out a CSRF attack.

The vulnerability of the token verification mechanism in the Apache Struts software framework is related to insufficient validation of the authenticity of executed requests. Exploiting this vulnerability allows a malicious actor to carry out a CSRF attack remotely...

CVE-2022-2075

In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validation...

Design/Logic Flaw

In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validation...

Octopus Deploy 安全漏洞

Octopus Deploy is an automation tool for .NET, Java, and other application development and deployment from Octopus Deploy Australia. A security vulnerability exists in Octopus Deploy that stems from performing a regular expression denial of service against build information request validation...

The vulnerability of the monitoring tool for the virtual infrastructure vRealize Operations lies in insufficient validation of incoming requests, allowing a perpetrator to disclose sensitive information.

The vulnerability of the monitoring tool for the vRealize Operations virtual infrastructure is related to insufficient checking of incoming requests. Exploiting this vulnerability could allow a malicious actor, operating remotely, to disclose sensitive information...

The vulnerability of the software for managing virtual infrastructure, VMware vCenter Server, and the virtualization platform, VMware Cloud Foundation, is related to insufficient checking of incoming requests. This allows a perpetrator to carry out an SSRF attack.

The vulnerability of the software for managing virtual infrastructure, such as VMware vCenter Server and VMware Cloud Foundation, is related to insufficient validation of incoming requests. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack by sending specially craft...

GO-2022-0534 Timing attack in github.com/runatlantis/atlantis

Validation of Gitlab requests can leak secrets. The package github.com/runatlantis/atlantis/server/controllers/events uses a non-constant time comparison for secrets while validating a Gitlab request. This allows for a timing attack where an attacker can recover a secret and then forge the reques...

Code injection

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an authenticated, remote attacker to delete arbitrary files from an affected system. This...

CVE-2022-25763 Improper input validation on HTTP/2 headers

Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache poison attacks. This issue affects Apache Traffic Server 8.0.0 to 9.1.2...

CVE-2022-20816

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an authenticated, remote attacker to delete arbitrary files from an affected system. This...

PT-2022-22688 · Ibm · Ibm Security Verify Information Queue

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Information Queue version 10.0.2 Description: The issue allows an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts due to cross-site request forgery. Recommendations: F...

CVE-2022-20900

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of...

CVE-2022-20897

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of...

CVE-2022-20880

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of...

SSRF via Import URL

Description While importing CSV and Excel file via an URL, the server does not validate requests properly that's how the attacker can able to make requests to internal servers and access the contents. Proof of Concept 1. Go to any project 2. From Dashboard, click on Add / Import CSV or Microsoft...

Apache APISIX < 2.13.0 Input Validation

The version of Apache APISIX installed on the remote host is prior to 2.13.0. It is, therefore, potentially affected by an input validation vulnerability. When decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a duplicate key, t...