11073 matches found
guava: local information disclosure via temporary directory created with unsafe permissions
A flaw was found in Guava that creates temporary directories with default permissions similar to /tmp. This issue may allow local users access, possibly permitting information exposure...
Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Ruby vulnerabilities (USN-4882-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4882-1 advisory. It was discovered that the Ruby JSON gem incorrectly handled certain JSON files. If a user or automated system were tricked into...
CVE-2021-26295
Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz...
CVE-2021-26295
Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz...
CVE-2021-26295
Apache OFBiz contains an unsafe Java deserialization vulnerability in requests leading to remote takeover on versions prior to 17.12.06. Multiple sources (including MSF exploit for the SOAP endpoint prior to 17.12.06) describe PoCs/Exploits and DNS-log-based validation. Affected component is OFBi...
Prototype Pollution
Overview swiper is a Most modern mobile touch slider and framework with hardware accelerated transitions Affected versions of this package are vulnerable to Prototype Pollution via the swiper.default.extendDefaults function due to the recursively calling of extend function in the source files...
Critical RCE Vulnerability Found in Apache OFBiz ERP Software—Patch Now
The Apache Software Foundation on Friday addressed a high severity vulnerability in Apache OFBiz that could have allowed an unauthenticated adversary to remotely seize control of the open-source enterprise resource planning ERP system. Tracked as CVE-2021-26295, the flaw affects all versions of t...
CVE-2021-26295
Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz. Recent assessments: zeroSteiner at March 31, 2021 1:24pm UTC reported: This vulnerability is pretty straightforward to exploit. It is due to an...
PT-2021-2512 · Apache · Apache Ofbiz
Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 17.12.06 Description: The issue is related to unsafe deserialization in Apache OFBiz, allowing an unauthenticated attacker to take over the system. This can impact the confidentiality, integrity, and availabilit...
The vulnerability of the readValue method in the ObjectMapper class of the Jackson-databind library arises from the possibility of restoring unreliable data structures in memory. This allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.
The vulnerability of the readValue method in the ObjectMapper class of the Jackson-databind library is related to improper validation of the data before it is deserialized. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause...
CVE-2021-21387
Wrongthink peer-to-peer, end-to-end encrypted messenger with PeerJS and Axolotl ratchet. In wrongthink from version 2.0.0 and before 2.3.0 there was a set of vulnerabilities causing inadequate encryption strength. Part of the secret identity key was disclosed by the fingerprint used for connectio...
Gitlab -- Multiple vulnerabilities
Gigtlab reports: Remote code execution via unsafe user-controlled markdown rendering options...
guava: local information disclosure via temporary directory created with unsafe permissions
A flaw was found in Guava that creates temporary directories with default permissions similar to /tmp. This issue may allow local users access, possibly permitting information exposure...
guava: local information disclosure via temporary directory created with unsafe permissions
A flaw was found in Guava that creates temporary directories with default permissions similar to /tmp. This issue may allow local users access, possibly permitting information exposure...
guava: local information disclosure via temporary directory created with unsafe permissions
A flaw was found in Guava that creates temporary directories with default permissions similar to /tmp. This issue may allow local users access, possibly permitting information exposure...
guava: local information disclosure via temporary directory created with unsafe permissions
A flaw was found in Guava that creates temporary directories with default permissions similar to /tmp. This issue may allow local users access, possibly permitting information exposure...
Security Bulletin: IBM Network Performance Insight 1.3.1 was affected by multiple vulnerabilities in jackson-databind
Summary IBM Network Performance Insight 1.3.1 was affected by multiple vulnerabilities in jackson-databind Vulnerability Details CVEID: CVE-2020-36185 DESCRIPTION: FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization...
USN-4804-1 puppet vulnerabilities
It was discovered that Puppet installed modules with world writable permissions. An attacker could use this vulnerability to execute arbitrary code or cause a denial of service. CVE-2017-10689 It was discovered that Puppet could be used to force YAML deserialization in an unsafe manner. A remote...