6173 matches found
CVE-2023-41916
In Apache Linkis =1.4.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will trigger arbitrary file reading. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. This attack requires...
CVE-2023-46801
In Apache Linkis = 1.8.0241. Or users upgrade Linkis to version 1.6.0...
CVE-2023-46801 Apache Linkis DataSource: DataSource Remote code execution vulnerability
In Apache Linkis = 1.8.0241. Or users upgrade Linkis to version 1.6.0...
CVE-2023-46801 Apache Linkis DataSource: DataSource Remote code execution vulnerability
In Apache Linkis = 1.8.0241. Or users upgrade Linkis to version 1.6.0...
CVE-2023-46801 Apache Linkis DataSource: DataSource Remote code execution vulnerability
In Apache Linkis = 1.8.0241. Or users upgrade Linkis to version 1.6.0...
CVE-2023-46801
Apache Linkis vulnerable to remote code execution in the DataSource MySQL handler for versions = 1.8.0_241 and/or upgrade Linkis to version 1.6.0. If upgrading is not immediately possible, validate and restrict JRMP usage and account privileges to reduce exposure. If exploitation details are not ...
CVE-2023-41916
CVE-2023-41916 affects Apache Linkis DataSource Manager: inadequate filtering of parameters allows an authorized attacker to configure malicious MySQL JDBC parameters and trigger arbitrary file reads in Linkis
CVE-2024-6540 Information exlosure in external interface
Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authorized user to download a list of tickets containing information about tickets of other customers. The problem only occurs if the TicketSearchLegacyEngine has be...
CVE-2024-6540 Information exlosure in external interface
Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authorized user to download a list of tickets containing information about tickets of other customers. The problem only occurs if the TicketSearchLegacyEngine has be...
OTRS Security Vulnerabilities
OTRS is a software application from the German company OTRS. A service management software. A security vulnerability exists in OTRS that stems from improper field filtering, which could allow an authorized user to download work order lists that contain information about other customers' work orde...
PT-2024-28729 · Thruk · Thruk
Name of the Vulnerable Software and Affected Versions: Thruk versions prior to 3.16 Description: This issue allows authorized users with network access to inject arbitrary commands via the URL parameter during PDF report generation. The Thruk web application does not properly process the url...
PT-2024-5102 · Apache · Apache Linkis
Name of the Vulnerable Software and Affected Versions: Apache Linkis versions =1.5.0 Description: The issue is related to the lack of effective filtering of parameters in the DataSource Manager Module of Apache Linkis. This allows an attacker to configure malicious db2 parameters, resulting in jn...
PT-2024-5100 · Apache · Apache Linkis
Name of the Vulnerable Software and Affected Versions: Apache Linkis versions = 1.8.0 241. For Apache Linkis versions = 1.5.0, upgrade Linkis to version 1.6.0...
PT-2024-5874 · Hashicorp +2 · Vault Enterprise +3
Name of the Vulnerable Software and Affected Versions: Vault and Vault Enterprise versions prior to 1.15.12 Vault and Vault Enterprise versions prior to 1.16.6 Vault and Vault Enterprise versions prior to 1.17.2 Description: The issue is related to the improper handling of requests originating fr...
Expedition: Missing Authentication Leads to Admin Account Takeover
Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credential...
Siemens RUGGEDCOM 信息泄露漏洞
Siemens RuggedCom ROS is an operating system from Siemens, Germany, used in the RuggedCom series of switches. An information disclosure vulnerability exists in Siemens RUGGEDCOM ROS, which can be exploited by an attacker to retrieve a MACSEC key and access decrypt Ethernet frames sent by an...
CVE-2024-6434
The Premium Addons for Elementor plugin for WordPress is vulnerable to Regular Expression Denial of Service ReDoS in all versions up to, and including, 4.10.35. This is due to processing user-supplied input as a regular expression. This makes it possible for authenticated attackers, with...
CVE-2024-5666
The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the EE Button widget in all versions up to, and including, 2.0.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...