519 matches found
PT-2021-5449 · Foxit · Foxit Pdf Reader
Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this issue, where the target mus...
SilverStripe 输入验证错误漏洞
Silverstripe SilverStripe is New Zealand SilverStripe Silverstripe company's set of open source programming framework and content management system CMS. The system has support for multiple languages , cross-platform and other features . SilverStripe has a security vulnerability that stems from a...
PT-2021-11214 · Silverstripe · Silverstripe
Name of the Vulnerable Software and Affected Versions: SilverStripe versions prior to 4.6.0-rc1 Description: The issue arises when a FormField with square brackets in the field name is used, causing it to skip validation. Specifically, the FileField class, commonly used for file upload, can be...
CVE-2020-26138 FormField: with square brackets in field name skips validation
More info at https://www.silverstripe.org/download/security-releases/cve-2020-26138...
GO-2020-0009 Integer overflow in github.com/square/go-jose
On 32-bit platforms an attacker can manipulate a ciphertext encrypted with AES-CBC with HMAC such that they can control how large the input buffer is when computing the HMAC authentication tag. This can can allow a manipulated ciphertext to be verified as authentic, opening the door for padding...
GO-2020-0010 Elliptic curve key disclosure in github.com/square/go-jose
When using ECDH-ES an attacker can mount an invalid curve attack during decryption as the supplied public key is not checked to be on the same curve as the receivers private key...
Unable to type the left bracket "[" in published desktop via Workspace app for HTML5
Users cannot type left square bracket "" in published desktop Accessing published desktop via Workspace app for HTML5 through Mozilla Firefox...
CVE-2021-23331
This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file...
hankyu-square.jp Cross Site Scripting vulnerability OBB-1355125
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Unspecified Vulnerability in Mattermost Server (CNVD-2020-41491)
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 5.8.0. The vulnerability can be exploited by an attacker to perform unauthorized operations when Town Square is set to read-onl...
CVE-2019-20883
An issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only. Users can pin or unpin a post...
Code injection
An issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only. Users can pin or unpin a post...
square-invest.be Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1187934 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
CVE-2019-20055
LuquidPixels LiquiFire OS 4.8.0 allows SSRF via the call%3Durl substring followed by a URL in square brackets...
Server side request forgery (ssrf)
LuquidPixels LiquiFire OS 4.8.0 allows SSRF via the call%3Durl substring followed by a URL in square brackets...
villagesquare.in Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1014626 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
Cryptovenom - The Cryptography Swiss Army Knife
CryptoVenom: The Cryptography Swiss Army knife What is CryptoVenom? CryptoVenom is an OpenSource tool which contains a lot of cryptosystems and cryptoanalysis methods all in one, including classical algorithms, hash algorithms, encoding algorithms, logic gates, mathematical functions, modern...
Black Hat USA 2019 Preview
Las Vegas – Despite bizarre reports of a grasshopper infestation, Black Hat USA 2019 and DEF CON are set to kick off next week in Las Vegas, bringing on a wave of sessions, keynotes and security-themed villages. The Threatpost team, which will be on the frontlines of next week’s shows, discuss wh...
Denial Of Service (DoS)
condor is vulnerable to denial of service DoS attacks. The vulnerability exists as aviary/jobcontrol.py in Condor, as used in Red Hat Enterprise MRG 2.3, when removing a job, allows remote attackers to cause a denial of service condorschedd restart via square brackets in the cproc option...
CVE-2018-1000844
Square Open Source Retrofit version Prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 contains a XML External Entity XXE vulnerability in JAXB that can result in An attacker could use this to remotely read files from the file system or to perform SSRF.. This vulnerability appears to have...