CVE-2022-4336

In BAOTA linux panel there exists a stored xss vulnerability attackers can use to obtain sensitive information via the log analysis feature...

CVE-2022-4336

In BAOTA linux panel there exists a stored xss vulnerability attackers can use to obtain sensitive information via the log analysis feature...

Cross site scripting

In BAOTA linux panel there exists a stored xss vulnerability attackers can use to obtain sensitive information via the log analysis feature...

BAOTA 跨站脚本漏洞

BAOTA linux is a simple and easy-to-use Linux server operation and management panel from China Pagoda Panel BAOTA company. A security vulnerability exists in BAOTA. An attacker can exploit this vulnerability to obtain sensitive information through the log analysis function...

CVE-2022-4336

CVE-2022-4336 describes a stored cross-site scripting vulnerability in the BAOTA Linux Panel, exploitable via the log analysis feature to obtain sensitive information. Affected software is BAOTA Linux Panel; the underlying issue is a stored XSS flaw in the log analysis workflow. The provided sour...

CVE-2022-4336

In BAOTA linux panel there exists a stored xss vulnerability attackers can use to obtain sensitive information via the log analysis feature...

PT-2022-26868 · Unknown · Baota Linux Panel

Name of the Vulnerable Software and Affected Versions: BAOTA linux panel affected versions not specified Description: The issue is related to a stored XSS vulnerability in the BAOTA linux panel. Attackers can exploit this to obtain sensitive information through the log analysis feature...

CVE-2022-4336

In BAOTA linux panel there exists a stored xss vulnerability attackers can use to obtain sensitive information via the log analysis feature...

CVE-2022-23496 A crafted list can trigger a ArrayIndexOutOfBoundsException in Yauaa

Yet Another UserAgent Analyzer Yauaa is a java library that tries to parse and analyze the useragent string and extract as many relevant attributes as possible. Applications using the Client Hints analysis feature introduced with 7.0.0 can crash because the Yauaa library throws an...

CVE-2022-23496 A crafted list can trigger a ArrayIndexOutOfBoundsException in Yauaa

Yet Another UserAgent Analyzer Yauaa is a java library that tries to parse and analyze the useragent string and extract as many relevant attributes as possible. Applications using the Client Hints analysis feature introduced with 7.0.0 can crash because the Yauaa library throws an...

GSD-2022-1007703 perf: Improve missing SIGTRAP checking

perf: Improve missing SIGTRAP checking This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.10 by commit b09221f1b4944d2866d06ac35e59d7a6f8916c9...

Upgraded Q -> H from #439 [1670433195074]

Judge has assessed an item in Issue 439 as H risk. The relevant finding follows: L02 - close should not be able to close a specific id credit line As per the docs: Can a Borrower chose to repay any debt in any order? No. The app automatically selects which credit line can be repaid using a...

CVE-2022-23470

Galaxy is an open-source platform for data analysis. An arbitrary file read exists in Galaxy 22.01 and Galaxy 22.05 due to the switch to Gunicorn, which can be used to read any file accessible to the operating system user under which Galaxy is running. This vulnerability affects Galaxy 22.01 and...

Design/Logic Flaw

Galaxy is an open-source platform for data analysis. An arbitrary file read exists in Galaxy 22.01 and Galaxy 22.05 due to the switch to Gunicorn, which can be used to read any file accessible to the operating system user under which Galaxy is running. This vulnerability affects Galaxy 22.01 and...

CVE-2022-23470 Arbitrary file access in the Galaxy data analysis platform

Galaxy is an open-source platform for data analysis. An arbitrary file read exists in Galaxy 22.01 and Galaxy 22.05 due to the switch to Gunicorn, which can be used to read any file accessible to the operating system user under which Galaxy is running. This vulnerability affects Galaxy 22.01 and...

CVE-2022-23470 Arbitrary file access in the Galaxy data analysis platform

Galaxy is an open-source platform for data analysis. An arbitrary file read exists in Galaxy 22.01 and Galaxy 22.05 due to the switch to Gunicorn, which can be used to read any file accessible to the operating system user under which Galaxy is running. This vulnerability affects Galaxy 22.01 and...

CVE-2022-23470

CVE-2022-23470 affects Galaxy, an open‑source data analysis platform. The issue is an arbitrary file read in Galaxy 22.01 and 22.05 after the switch to Gunicorn, allowing access to any file the OS user running Galaxy can read. The vulnerability is relevant to Galaxy versions 22.01 and higher that...

Security Bulletin: Vulnerability in IBM WebSphere Application Server and IBM WebSphere Application Server Liberty affects IBM Operations Analytics - Log Analysis (CVE-2022-34165)

Summary IBM WebSphere Application Server is vulnerable to HTTP header injection when processing web requests. This has been addressed. Vulnerability Details CVEID:CVE-2022-34165 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty...

CVE-2022-4262

creationtimestamp| type| source ---|---|--- 2022-12-05 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=926 2022-12-05 11:10:43+00:00| exploited| https://t.me/truesecator/3783 2022-12-06 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=927 2022-12-06...

Upgraded Q -> M from #400 [1670236164031]

Judge has assessed an item in Issue 400 as M risk. The relevant finding follows: L04 - LiquidStakingManager.dao can rug node operators with executeAsSmartWallet daoCommissionPercentage is used to calculate the portion of node operator network rewards that are sent to dao, when a node runner is...