DEBIAN-CVE-2022-42890

A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16...

GHSA-4X63-3P7Q-XMH7 Jenkins HTML Publisher Plugin path traversal vulnerability

A path traversal vulnerability exists in Jenkins HTML Publisher Plugin 1.15 and older in HtmlPublisherTarget.java that allows attackers able to configure the HTML Publisher build step to override arbitrary files on the Jenkins master. In version 1.16, non-alphanumeric characters in report names a...

CVE-2022-29950

Experian Hunter 1.16 allows remote authenticated users to modify assumed-immutable elements via the 1 rule name parameter to the Rules page or the 2 subrule name or 3 categories name parameter to the Subrules page. NOTE: the vendor disputes this because version 1.16 has never existed...

Experian Hunter 安全漏洞

Experian Hunter is used by Experian to prevent application fraud across all channels. A security vulnerability exists in Experian Hunter version 1.16. A remote attacker exploited the vulnerability to modify Experian Hunter via 1 the Rule Name parameter on the Rule page 2 the Sub-Rule Name 3 the...

PT-2022-19391 · Jenkins · Jenkins Publish Over Ftp Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Publish Over FTP Plugin versions 1.16 and earlier Description: The issue is related to missing permission checks in the Jenkins Publish Over FTP Plugin, which allows attackers with Overall/Read permission to connect to an FTP server...

CVE-2021-43142

An XML External Entity XXE vulnerability exists in wuta jox 1.16 in the readObject method in JOXSAXBeanInput...

Mitsubishi Electric MELSEC-F Series

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Mitsubishi Electric Equipment: MELSEC-F Series Vulnerability: Improper Initialization 2. RISK EVALUATION Successful exploitation of this vulnerability may cause a denial-of-service condition in the...

Design/Logic Flaw

encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader for xml.NewTokenDecoder returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method...

jenkins-2-plugins/matrix-project: Stored XSS vulnerability in single axis builds tooltips

A flaw was found in the Matrix Project Plugin version 1.16 and prior. Node names shown in tooltips are not escaped on the overview page of builds with a single axis which could lead to a stored cross-site scripting XSS vulnerability. The user must have the Agent/Configure permission for this...

cairo 1.16.0 in cairo_ft_apply_variations() in cairo-ft-font.c would free memory using a free function incompatible with WebKit's fastMalloc leading to an application crash with a "free(): invalid pointer" error.

...

CVE-2020-2224

A flaw was found in the Matrix Project Plugin version 1.16 and prior. Node names shown in tooltips are not escaped on the overview page of builds with a single axis which could lead to a stored cross-site scripting XSS vulnerability. The user must have the Agent/Configure permission for this...

PT-2020-15441 · Jenkins · Jenkins Matrix Project Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Matrix Project Plugin versions 1.16 and earlier Description: The issue is related to a stored cross-site scripting vulnerability. It occurs because the axis names shown in tooltips on the overview page of builds with multiple axes are...

CVE-2020-8552

The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests...

Kubelet DoS via API

CVSS Rating: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Medium The Kubelet has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port...

[SECURITY] [DLA 1760-1] wget security update

Package : wget Version : 1.16-1+deb8u6 CVE ID : CVE-2019-5953 Kusano Kazuhiko discovered a buffer overflow vulnerability in the handling of Internationalized Resource Identifiers IRI in wget, a network utility to retrieve files from the web, which could result in the execution of arbitrary code o...

UBUNTU-CVE-2015-8316

Array index error in LightDM aka Light Display Manager 1.14.3, 1.16.x before 1.16.6 when the XDMCP server is enabled allows remote attackers to cause a denial of service process crash via an XDMCP request packet with no address...

XWayland Arbitrary File Read Vulnerability

Wayland is a simple "display server. A security vulnerability in the authentication settings of XWayland version 1.16.x and version 1.17.x prior to 1.17.2 can be exploited by a local attacker to read information from or send information to any X11 client with the help of a UNIX socket...

P-News 1.16 Administrative Account Creation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7689/info A vulnerability has been reported that could enable a P-News member to create and access an administrative account. This is due to insufficient validation of data supplied to account editing input fields of...

Mojolicious Directory Traversal Vulnerability

The host is running Mojolicious and is prone to directory traversal vulnerability. OpenVAS Vulnerability Test $Id: gbmojoliciousdirtravvuln.nasl 7577 2017-10-26 10:41:56Z cfischer $ Mojolicious Directory Traversal Vulnerability Authors: Sooraj KS Copyright: Copyright c 2011 Greenbone Networks Gmb...

DEBIAN-CVE-2010-1647

Cross-site scripting XSS vulnerability in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets CSS strings that are processed as script by Internet Explorer...