CVE-2022-24983

CVE-2022-24983 concerns forms generated by JQueryForm.com before 2022-02-05. The vulnerability allows remote attackers to obtain the URI of uploaded files by capturing the POST response (the Unique ID is included in the response). This is stated to enable unauthenticated remote code execution whe...

CVE-2022-25236

xmlparse.c in Expat aka libexpat before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs...

PHPUnit Command Injection Vulnerability

PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI...

CVE-2022-25236

xmlparse.c in Expat aka libexpat before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs...

Fortinet FortiMail Cross-Site Scripting Vulnerability (CNVD-2022-19073)

Fortinet FortiMail is a suite of email security gateway products from Fortinet, Inc. Fortinet FortiMail is vulnerable to a cross-site scripting vulnerability that could be exploited to execute unauthorized code or commands via a specially crafted HTTP GET request to the FortiGuard URI protection...

CVE-2022-24129

The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery SSRF due to insufficient restriction of the requesturi parameter. This allows attackers to interact with arbitrary third-party HTTP services...

Shibboleth 代码问题漏洞

Shibboleth is an open source SAML-based Web single sign-on system for Windows platforms from Shibboleth, UK. A security vulnerability exists in the Shibboleth Identity Provider, which stems from an under-restricted requesturi parameter, in the OIDC OP plugin for the Shibboleth Identity Provider...

Node.js 12.x < 12.22.9 / 14.x < 14.18.3 / 16.x < 16.13.2 / 17.x < 17.3.1 Multiple Vulnerabilities (January 10th 2022 Security Releases).

The version of Node.js installed on the remote host is prior to 12.22.9, 14.18.3, 16.13.2, 17.3.1. It is, therefore, affected by multiple vulnerabilities as referenced in the January 10th 2022 Security Releases advisory. - Accepting arbitrary Subject Alternative Name SAN types, unless a PKI is...

CVE-2021-43062

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to...

Cross site scripting

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to...

CVE-2021-43062

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to...

CVE-2021-43062

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to...

CVE-2021-43062

Summary: CVE-2021-43062 affects Fortinet FortiMail across multiple versions (7.0.1/7.0.0, 6.4.5 and below, 6.3.7 and below, 6.0.11 and below). It is a Cross-Site Scripting vulnerability caused by improper neutralization of input during web page generation, exploitable via crafted HTTP GET request...

Debian DLA-2907-1 : apache2 - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2907 advisory. - A crafted URI sent to httpd configured as a forward proxy ProxyRequests on can cause a crash NULL pointer dereference or, for configurations mixing forward and...

Design/Logic Flaw

Element Desktop is a Matrix client for desktop platforms with Element Web at its core. Element Desktop before 1.9.7 is vulnerable to a remote program execution bug with user interaction. The exploit is non-trivial and requires clicking on a malicious link, followed by another button click. To the...

CVE-2022-23597 Remote program execution with user interaction

Element Desktop is a Matrix client for desktop platforms with Element Web at its core. Element Desktop before 1.9.7 is vulnerable to a remote program execution bug with user interaction. The exploit is non-trivial and requires clicking on a malicious link, followed by another button click. To the...

FortiMail - reflected cross-site scripting vulnerability in FortiGuard URI protection

An improper neutralization of input during web page generation vulnerability 'Cross-site Scripting' CWE-79 in FortiMail may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests to the FortiGuard URI protection service...

OESA-2022-1505 uriparser security update

The package is a strictly RFC 3986 compliant URI parsing library written in C89"ANSI C". uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license. There are a number of applications, libraries and hardware using uriparser, as well as bindings and 3rd-party...

Scientific Linux Security Update : java-1.8.0-openjdk on SL7.x i686/x86_64 (2022:0306)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:0306-1 advisory. - OpenJDK: Incomplete deserialization class filtering in ObjectInputStream Serialization, 8264934 CVE-2022-21248 - OpenJDK: Insufficient URI chec...

RHEL 7 : java-1.8.0-openjdk (RHSA-2022:0306)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0306 advisory. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security...