Reflected XSS vulnerability in credentials

credentials 2.3.18 and earlier does not escape user-controlled information on a view it provides. This results in a reflected cross-site scripting XSS vulnerability. credentials 2.3.19 restricts the user-controlled information it provides to a safe subset...

Apple macOS Big Sur路径遍历漏洞

Apple macOS Big Sur is a mobile application app from Apple Inc. Apple macOS Big Sur suffers from a path traversal vulnerability that affects the following products and versions: macOS 11.0 20A2411, 11.0.1 20B29, 11.0.1 20B50, 11.1 20C69, 11.2 20D64, 11.2.1 20D74, 11.2.1 20D75, 11.2.2 20D80, 11.2....

DEBIAN-CVE-2018-1110

A flaw was found in knot-resolver before version 2.3.0. Malformed DNS messages may cause denial of service...

Rust 跨站脚本漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in versions of Rust prior to 2.3.0. The vulnerability stems from the possibility of request smuggling when the program is used behind a reverse proxy. No detailed vulnerability...

SQL Injection Vulnerability in yycms Movie & TV System V2.3 Admin Catalog yy***_km***.php

yycms is a movie and television system. yycms film and television system V2.3 version admin directory yykm.php SQL injection vulnerability, an attacker can use the vulnerability to obtain database sensitive information...

IBM Cloud Pak System Information Disclosure Vulnerability (CNVD-2021-01064)

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. An information disclosure vulnerability exists in IBM Cloud Pak System 2.3. An attacker could exploit this vulnerability to obtain credential information from an HTTP response...

IBM Cloud Pak System Cross-Site Scripting Vulnerability (CNVD-2021-00889)

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. A cross-site scripting vulnerability exists in IBM Cloud Pak System 2.3. An attacker could exploit the vulnerability to embed arbitrary JavaScript code in the Web UI that could...

IBM Cloud Pak System Arbitrary File Upload Vulnerability (CNVD-2021-01067)

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. An arbitrary file upload vulnerability exists in IBM Cloud Pak System 2.3. An attacker can exploit this vulnerability by intercepting requests and modifying the file extension t...

IBM Cloud Pak System Elevation of Privilege Vulnerability

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. An elevation of privilege vulnerability exists in the self-service console of IBM Cloud Pak System 2.3. An attacker could exploit the vulnerability by capturing a user request U...

DEBIAN-CVE-2020-35495

There's a flaw in binutils /bfd/pef.c. An attacker who is able to submit a crafted input file to be processed by the objdump program could cause a null pointer dereference. The greatest threat from this flaw is to application availability. This flaw affects binutils versions prior to 2.34...

CVE-2020-4913

IBM Cloud Pak System 2.3 could reveal credential information in the HTTP response to a local privileged user. IBM X-Force ID: 191288...

IBM Cloud Pak System 代码问题漏洞

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. An arbitrary file upload vulnerability exists in IBM Cloud Pak System 2.3. An attacker can exploit this vulnerability by intercepting requests and modifying the file extension t...

IBM Cloud Pak System 安全漏洞

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. A session fixation vulnerability exists in IBM Cloud Pak System 2.3. An attacker could exploit this vulnerability to emulate another user on the system...

IBM Cloud Pak System 跨站脚本漏洞

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. A cross-site scripting vulnerability exists in IBM Cloud Pak System 2.3. An attacker could exploit the vulnerability to embed arbitrary JavaScript code in the Web UI that could...

IBM Cloud Pak System 信息泄露漏洞

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. An information disclosure vulnerability exists in IBM Cloud Pak System 2.3. An attacker could exploit this vulnerability to obtain credential information from an HTTP response...

CVE-2020-26049

Nifty-PM CPE 2.3 is affected by stored HTML injection. The impact is remote arbitrary code execution...

Http-rs Async-h1 Environment Issue Vulnerability

Http-rs Async-h1 is a Rust-based asynchronous Http parser from the Http-rs team. A security vulnerability exists in async-h1 versions prior to 2.3.0, which stems from the presence of a request smuggling vulnerability. This vulnerability affects any web server that uses async-h1 behind a reverse...

Niftypm Injection Vulnerability

Niftypm is a project management application from Niftypm USA. The application centralizes modern work content and supports features such as chat, tasks, documents, calendars, meetings, and more. Niftypm CPE 2.3 suffers from an injection vulnerability that originates from remote arbitrary code...

PT-2020-4581 · Adobe · Magento Commerce

Name of the Vulnerable Software and Affected Versions: Magento Commerce versions 2.3.4 and earlier Magento Commerce version 2.4.0 Description: The issue exists due to insufficient input validation, potentially allowing a remote attacker to access confidential information. In maintenance mode, an...

PYSEC-2020-315

In Tensorflow before version 2.3.1, the RaggedCountSparseOutput implementation does not validate that the input arguments form a valid ragged tensor. In particular, there is no validation that the values in the splits tensor generate a valid partitioning of the values tensor. Thus, the code sets ...