Linux Distros Unpatched Vulnerability : CVE-2017-16908

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Horde Groupware 5.2.19, there is XSS via the Name field during creation of a new Resource. This can be leveraged for remote code execution after compromising...

CVE-2024-57435

In macrozheng mall-tiny 1.0.1, an attacker can send null data through the resource creation interface resulting in a null pointer dereference occurring in all subsequent operations that require authentication, which triggers a denial-of-service attack and service restart failure...

CVE-2023-27526

A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0...

Keycloak 输入验证错误漏洞

Keycloak is an open source identity and access management solution from Keycloak Open Source. Keycloak suffers from an input validation error vulnerability that stems from an administrator mishandling a malicious payload when creating a resource, which can lead to a stored cross-site scripting...

mall-tiny 安全漏洞

mall-tiny is a rapid development scaffolding for macro individual developers. A security vulnerability exists in mall-tiny version 1.0.1, which originates from an attacker who can send null data through the resource creation interface, triggering a denial-of-service attack and service restart...

CVE-2024-57435

In macrozheng mall-tiny 1.0.1, an attacker can send null data through the resource creation interface resulting in a null pointer dereference occurring in all subsequent operations that require authentication, which triggers a denial-of-service attack and service restart failure...

PT-2025-3442 · Unknown · Macrozheng Mall-Tiny

Name of the Vulnerable Software and Affected Versions: macrozheng mall-tiny version 1.0.1 Description: The issue allows an attacker to send null data through the resource creation interface, resulting in a null pointer dereference in all subsequent operations that require authentication. This...

CVE-2024-57435

In macrozheng mall-tiny 1.0.1, an attacker can send null data through the resource creation interface resulting in a null pointer dereference occurring in all subsequent operations that require authentication, which triggers a denial-of-service attack and service restart failure...

GHSA-5545-R4HG-RJ4M Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path

A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider...

Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path

A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider...

Duplicate Advisory: Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5545-r4hg-rj4m. This link is maintained to preserve external references. Original Description A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file...

CVE-2024-10492 Keycloak-quarkus-server: keycloak path trasversal

A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider...

CVE-2024-10492

CVE-2024-10492 in Keycloak enables a high-privilege user to read a Vault file outside the expected context by leveraging a crafted Vault read file after gaining prior high access (e.g., via LDAP provider configuration). The issue phrasing across connected advisories confirms this path-traversal-l...

Apache Superset Security Bypass Vulnerability

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A security bypass vulnerability exists in Apache Superset version 2.1.0 and prior versions, which can be exploited by an attacker to incorrectly create resources using the Import Chart feature...

Command injection

A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0...

CVE-2023-27526

CVE-2023-27526 affects Apache Superset up to version 2.1.0 and concerns an improper authorization check in the Import Charts feature. A non-admin authenticated user could potentially create resources via that feature, enabling unintended resource creation. The provided connected sources consisten...

CVE-2023-27526 Apache Superset: Improper Authorization check on import charts

A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0...

PT-2023-21193

Name of the Vulnerable Software and Affected Versions Apache Superset versions up to and including 2.1.0 Description A non-admin authenticated user could incorrectly create resources using the import charts feature. Recommendations For Apache Superset versions up to and including 2.1.0, update to...

Apache Superset 安全漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A security bypass vulnerability exists in Apache Superset version 2.1.0 and prior versions, which can be exploited by an attacker to incorrectly create resources using the Import Chart feature...

OpenStack openstack-neutron 资源管理错误漏洞

OpenStack is a cloud platform management program of the National Aeronautics and Space Administration NASA. A security vulnerability exists in OpenStack openstack-neutron that stems from the unrestricted creation of resources by querying a list of security groups for an invalid project, which can...