9604 matches found
CVE-2021-3461
A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute Name...
MediaWiki 跨站脚本漏洞
MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. The product can be used to deploy in-house knowledge management and content management systems. A security vulnerability exists in MediaWiki that stems from the fact that the widthheight,...
CVE-2022-0427
Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP POST requests on a user's behalf leading to potential account takeover...
CVE-2022-0427
Removed by vendor...
expat: Integer overflow in defineAttribute in xmlparse.c
expat libexpat is susceptible to a software flaw that causes process interruption. When processing a large number of prefixed XML attributes on a single tag can libexpat can terminate unexpectedly due to integer overflow. The highest threat from this vulnerability is to availability,...
PT-2022-13176 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 14.5 and later Description: The issue is related to missing sanitization of HTML attributes in Jupyter notebooks, allowing an attacker to perform arbitrary HTTP POST requests on a user's behalf, potentially leading to...
[SECURITY] Fedora 36 Update: shapelib-1.5.0-12.fc36
The Shapefile C Library provides the ability to write simple C programs for reading, writing and updating to a limited extent ESRI Shapefiles, and the associated attribute file .dbf...
[SECURITY] Fedora 36 Update: shapelib-1.5.0-11.fc36
The Shapefile C Library provides the ability to write simple C programs for reading, writing and updating to a limited extent ESRI Shapefiles, and the associated attribute file .dbf...
How to add secure attribute for citrix_ns_id cookie to Citrix Application Firewall Profile
Adding secure attribute for citrixnsid cookie...
expat: Integer overflow in nextScaffoldPart in xmlparse.c
expat libexpat is susceptible to a software flaw that causes process interruption. When processing a large number of prefixed XML attributes on a single tag can libexpat can terminate unexpectedly due to integer overflow. The highest threat from this vulnerability is to availability,...
389-ds-base: double free of the virtual attribute context in persistent search
A double free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash...
Design/Logic Flaw
Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identity management services. During the sign-in process, Keycloak sets browser cookies that effectively provide remember-me functionality. For backwards compatibility with older Safar...
Stored Cross-site Scripting vulnerability in Jenkins Dashboard View Plugin
Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure views. Dashboard View Plugin 2.18.1 performs URL validation for the...
389-ds-base: double free of the virtual attribute context in persistent search
A double free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash...
Low: Red Hat Security Advisory: 389-ds:1.4 security and bug fix update
An update for the 389-ds:1.4 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...
Gradle 信息泄露漏洞
Gradle is a set of JVM-based project building tools from Gradle, Inc. that supports maven, Ivy repositories, and more. Gradle Enterprise suffers from a security vulnerability that stems from the fact that during the login process, Keycloak sets a browser cookie that effectively provides remember-...
Cross site scripting
The Cybersoldier WordPress plugin before 1.7.0 does not sanitise and escape the URL settings before outputting it in an attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
SUSE-SU-2022:0826-1 Security update for sssd
This update for sssd fixes the following issues: Security issues fixed: - CVE-2021-3621: Fixed shell command injection in sssctl via the logs-fetch and cache-expire subcommands bsc1189492. Non-security issues fixed: - Create timestamp attribute in cache objects if missing. bsc1182637 - Add...