13340 matches found
DRUPAL-CONTRIB-2023-051
The GraphQL module enables you to build GraphQL APIs which can include data fetching through Queries and data updates create, update, delete through mutations. The module does not sufficiently validate incoming requests that are made from domains other than the one serving the GraphQL endpoint. I...
Reverse Tabnabbing
DOMPurify is vulnerable to reverse tabnabbing. The vulnerability is due to a missing rel="noopener noreferrer" attribute on links that use the target="blank" attribute. This can potentially lead to Phishing Attacks...
Security Bulletin: "Incorrect/Missing Security Headers" affects IBM CICS TX Advanced 10.1.
Summary "Cookie with Insecure, Improper or Missing SameSite attribute" vulnerability affects IBM CICS TX Advanced 10.1. IBM CICS TX Advanced has addressed the applicable vulnerability. Vulnerability Details CVEID:CVE-2023-38363 DESCRIPTION: IBM CICS TX Advanced does not set the secure attribute o...
golang: html/template: improper handling of empty HTML attributes
A flaw was found in golang. Templates containing actions in unquoted HTML attributes, for example, "attr=." executed with empty input, could result in output that has unexpected results when parsed due to HTML normalization rules. This issue may allow the injection of arbitrary attributes into ta...
kernel: drm/amdkfd: Fix kernel warning during topology setup
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix kernel warning during topology setup This patch fixes the following kernel warning seen during driver load by correctly initializing the p2plink attr before creating the sysfs file: +0.002865 ------------ cut here...
kernel: Linux kernel: Denial of Service in mlx5e due to incorrect encap attribute handling
A flaw was found in the mlx5e Traffic Control TC encapsulation logic in the net/mlx5e driver of the Linux kernel. The code responsible for invalidating encapsulation actions did not use the proper helper function to retrieve the correct encapsulation attribute, instead assuming the default...
golang: html/template: improper handling of empty HTML attributes
A flaw was found in golang. Templates containing actions in unquoted HTML attributes, for example, "attr=." executed with empty input, could result in output that has unexpected results when parsed due to HTML normalization rules. This issue may allow the injection of arbitrary attributes into ta...
golang: html/template: improper handling of empty HTML attributes
A flaw was found in golang. Templates containing actions in unquoted HTML attributes, for example, "attr=." executed with empty input, could result in output that has unexpected results when parsed due to HTML normalization rules. This issue may allow the injection of arbitrary attributes into ta...
tomcat: not including the secure attribute causes information disclosure
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure...
golang: html/template: improper handling of empty HTML attributes
A flaw was found in golang. Templates containing actions in unquoted HTML attributes, for example, "attr=." executed with empty input, could result in output that has unexpected results when parsed due to HTML normalization rules. This issue may allow the injection of arbitrary attributes into ta...
golang: html/template: improper handling of empty HTML attributes
A flaw was found in golang. Templates containing actions in unquoted HTML attributes, for example, "attr=." executed with empty input, could result in output that has unexpected results when parsed due to HTML normalization rules. This issue may allow the injection of arbitrary attributes into ta...
CVE-2023-33045
Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute...
Memory corruption
Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute...
CVE-2023-33045 Buffer Copy Without Checking Size of Input in WLAN Firmware
Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute...
CVE-2023-33045 Buffer Copy Without Checking Size of Input in WLAN Firmware
Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute...
CVE-2019-25155
DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute...
CVE-2019-25155
DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute...
PT-2023-24158 · Unknown · Wlan Firmware
Name of the Vulnerable Software and Affected Versions: WLAN Firmware affected versions not specified Description: The issue is related to memory corruption in the WLAN Firmware when it parses a NAN management frame that carries an S3 attribute. Recommendations: At the moment, there is no...
CVE-2023-46789: Improper Neutralization of Special Elements used in an SQL Command
Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'filename' attribute of the 'pic1' multipart parameter of the functions.php resource does not validate the characters received and they are sent unfiltered to the database...