13097 matches found
GHSA-5W5X-Q9P5-9QG3 OctoPrint does not have rate limiting on the login page
OctoPrint 1.7.3 and prior does not have rate limiting on the login page, making it possible for attackers to attempt brute force attacks. The severity of this issue is limited by OctoPrint normally running in a restricted LAN. The devel and maintenance branches of the repository have a fix that...
CVE-2022-2824 Authorization Bypass Through User-Controlled Key in openemr/openemr
Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1...
Path Traversal
venice is vulnerable to path traversal. The vulnerability exists in the isFileWithinDirectory function of LoadPaths.java, allowing an attacker to access files outside the configured load paths such as /Users/foo/resources/test.png and /Users/foo/resources-alt/test.png when passing the absolute...
DLA-3071-1 libtirpc - security update
Bulletin has no description...
PT-2022-4308 · Microsoft · Azure Rtos Guix Studio
Name of the Vulnerable Software and Affected Versions: Azure RTOS GUIX Studio affected versions not specified Description: The issue is related to insufficient input validation in the Azure RTOS GUIX Studio development environment. This can allow a remote attacker to execute arbitrary code...
DSA-5203-1 gnutls28 - security update
Bulletin has no description...
DSA-5201-1 chromium - security update
Bulletin has no description...
MAL-2022-6602 Malicious code in token_supply (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 243a1cdebf46b0a129f1297782839b64507b1e4a823ff1e593d79033dbebeceb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
GSD-2022-1004951 hashed password of the user who created or revoked the link disclosure in Slack version between April 17, 2017 and July 17, 2022
In Slack between April 17, 2017 and July 17, 2022 if a shared invite link was created or revoked the hashed password of the user who created or revoked the link would have been disclosed in the invitation link, allowing an attacked viewing the invitation link to see the hashed password also salte...
`libsqlite3-sys` via C SQLite improperly validates array index
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API...
Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Nginx
Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Nginx. Vulnerability Details CVEID:CVE-2021-3618 DESCRIPTION: Sendmail, vsftpd and NGINX could provide weaker than expected security, caused by an ALPACA application layer protocol content confusion attack,...
Command Injection
npos-tesseract is vulnerable to command injection. The vulnerability exists because the module.export function of ocr.js does not properly sanitize the options and image parameters, allowing an attacker to inject and execute malicious code...
CVE-2020-7795
The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js...
PT-2022-22030 · Ibm · Ibm Cics Tx
Name of the Vulnerable Software and Affected Versions: IBM CICS TX version 11.1 Description: The issue allows an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts due to cross-site request forgery. Recommendations: For IBM CICS TX version 11.1,...
PUB-A-228560328
Bulletin has no description...
PUB-A-211727306
Bulletin has no description...
CVE-2022-2598 Out-of-bounds Write to API in vim/vim
Out-of-bounds Write to API in GitHub repository vim/vim prior to 9.0.0100...
PUB-A-226679409
Bulletin has no description...