766 matches found
keycloak-services: ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader
ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available...
CVE-2022-31229
Dell PowerScale OneFS, 8.2.x through 9.3.0.x, contain an error message with sensitive information. An administrator could potentially exploit this vulnerability, leading to disclosure of sensitive information. This sensitive information can be used to access sensitive resources...
CVE-2021-35070
RPM secure Stream can access any secure resource due to improper SMMU configuration and can lead to information disclosure in Snapdragon Industrial IOT, Snapdragon Mobile...
CVE-2021-30345
RPM secure Stream can access any secure resource due to improper SMMU configuration in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking...
Input validation
RPM secure Stream can access any secure resource due to improper SMMU configuration in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking...
CVE-2021-30346
RPM secure Stream can access any secure resource due to improper SMMU configuration in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking...
GHSA-Q3X9-28F7-W8RC Total.js CMS Unauthorized Access
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with limited privileges can get access to a resource that they do not own by calling the associated API. The product correctly manages privileges only for the front-end resource path, not for API requests. This leads to vertica...
NodeSecurityShield - A Developer And Security Engineer Friendly Package For Securing NodeJS Applications
A Developer and Security Engineer friendly package for Securing NodeJS Applications. Inspired by the log4J vulnerability CVE-2021-44228 which can be exploited because an application can make arbitrary network calls. We felt there is an need for an application to declare what privileges it can hav...
Vulnerability of the Microsoft Office Graphics Package components in Microsoft Office programs, allowing a hacker to execute arbitrary code
The vulnerability of the Microsoft Office Graphics Package components in Microsoft Office products is related to access to resources through incompatible types. Exploiting this vulnerability could allow an attacker to execute arbitrary code in the context of the current user...
The vulnerability of JavaScript script handlers in Microsoft Edge and Google Chrome browsers allows attackers to disclose protected information.
The vulnerability of JavaScript script handlers in Microsoft Edge and Google Chrome browsers is related to access to resources through incompatible types. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information that is protected by these scripts...
CVE-2022-1316
Incorrect Permission Assignment for Critical Resource in GitHub repository zerotier/zerotierone prior to 1.8.8. Local Privilege Escalation...
多款Qualcomm产品配置错误漏洞
A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way to miniaturize circuits mainly semiconductor devices, but also passive components, etc., and from time to time fabricated on the surface of semiconductor wafers. Qualcomm A misconfiguration vulnerability exists in multiple products,...
GHSA-6V73-FGF6-W5J7 Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources...
The vulnerability of the Spring module routing mechanism, which facilitates business logic through Spring Cloud Function services, allows attackers to gain unauthorized access to local resources or cause service failures.
The vulnerability of the Spring module routing mechanism for promoting business logic using Spring Cloud Function is related to deficiencies in the process of eliminating special elements from the output data used by the incoming component. Exploiting this vulnerability can allow an attacker to...
CVE-2021-3456
An improper authorization handling flaw was found in Foreman. The Salt plugin for the smart-proxy allows foreman clients to execute actions that should be limited to the Foreman Server. This flaw allows an authenticated local attacker to access and delete limited resources and also causes a denia...
CVE-2021-40061
There is a vulnerability of accessing resources using an incompatible type type confusion in the Bastet module. Successful exploitation of this vulnerability may affect integrity...
CVE-2021-40061
There is a vulnerability of accessing resources using an incompatible type type confusion in the Bastet module. Successful exploitation of this vulnerability may affect integrity...
USN-5313-1 openjdk-lts, openjdk-17 vulnerabilities
It was discovered that OpenJDK incorrectly handled deserialization filters. An attacker could possibly use this issue to insert, delete or obtain sensitive information. CVE-2022-21248 It was discovered that OpenJDK incorrectly read uncompressed TIFF files. An attacker could possibly use this issu...