3360 matches found
Malicious code in azure-arm-servicemap-samples-ts-beta (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 879b0fdb17c1119e579e5f7d71290575b29a45995616e170b1d21d8d316d5b09 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Design/Logic Flaw
Discourse is an open-source discussion platform. Prior to version 2.8.4 in the stable branch and version 2.9.0.beta5 in the beta and tests-passed branches, banner topic data is exposed on login-required sites. This issue is patched in version 2.8.4 in the stable branch and version 2.9.0.beta5 in...
CVE-2022-24077
CVE-2022-24077 affects Naver Cloud Explorer Beta. Vulnerability arises from malicious DLL injection enabling an attacker to execute arbitrary code with SYSTEM privileges. The description across sources confirms local-priority abuse with high impact (complete confidentiality, integrity, and availa...
Electron 安全漏洞
Electron is a personal developer of a user to write cross-platform desktop application JavaScript framework. The framework is based on nodejs and Chromium and can be used to write cross-platform desktop applications using HTML and CSS. A security vulnerability exists in Electron version...
PT-2022-20469
Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2.8.4 on the stable branch Discourse versions prior to 2.9.0beta5 on the beta and tests-passed branches Description The issue affects Discourse, an open source platform for community discussion. Inviting users on...
CVE-2022-29232 Exposure of messages in BigBlueButton public chats
BigBlueButton is an open source web conferencing system. Starting with version 2.2 and prior to versions 2.3.9 and 2.4-beta-1, an attacker can circumvent access controls to obtain the content of public chat messages from different meetings on the server. The attacker must be a participant in a...
CVE-2022-29169 ReDoS on endpoint html5client/useragent in BigBlueButton
BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expression denial of service ReDoS attacks. By using specific a RegularExpression, an attacker can cause denial of service for the bbb-html5...
GHSA-F7FF-XF87-F22Q Arbitrary command execution in Minidoc
An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file...
Arbitrary command execution in Minidoc
An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file...
CVE-2022-29637
An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file...
Privilege escalation
An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file...
CVE-2022-29637
An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file...
GHSA-XHFX-RM8Q-C3XV Moodle Vulnerable to Reflected Cross-site Scripting
It was found in Moodle before version 4.0.0-beta that some search inputs were vulnerable to reflected Cross-site Scripting XSS due to insufficient escaping of search queries...
Feehi CMS arbitrary file upload vulnerability
Feehi CMS 2.1.0-beta is affected by an arbitrary file upload vulnerability, potentially resulting in remote code execution. After an administrator logs in, open the administrator image upload page to potentially upload malicious files...
GHSA-65X8-9VGM-5FG5 Feehi CMS arbitrary file upload vulnerability
Feehi CMS 2.1.0-beta is affected by an arbitrary file upload vulnerability, potentially resulting in remote code execution. After an administrator logs in, open the administrator image upload page to potentially upload malicious files...
com.azure:azure-messaging-eventhubs (>=5.0.0-beta.6 <=5.3.0-beta.1), com.azure:azure-messaging-eventhubs-checkpointstore-blob (>=1.0.0-beta.4 <=1.3.0-beta.1) +13 more potentially affected by CVE-2020-16971 via com.azure:azure-core-amqp (>=1.0.0-beta.8 <=1.6.0-beta.1)
com.azure:azure-core-amqp MAVEN version =1.0.0-beta.8, =5.0.0-beta.6, =1.0.0-beta.4, =7.0.0-beta.1, =1.1.3, =1.1.3, =1.1.3, =1.5.4-bkbase.1, =1.20.0, =1.3.0.Alpha1, =0.5.0, =3.5.0, =3.5.0, =1.1.21, =1.2.01 Source cves: CVE-2020-16971https://vul...
blosc2 heap-based buffer overflow
blosc2.c in Blosc C-Blosc2 through 2.0.0.beta.5 has a heap-based buffer overflow when there is a lack of space to write compressed data...
br.eti.clairton:ds-test (=0.4.0), ch.inftec.ju:ju-ee (>=6.0-2 <=6.1-S-5) +103 more potentially affected by CVE-2020-14297 via org.jboss:jboss-ejb-client (>=1.0.0.Beta12 <=4.0.33.Final)
org.jboss:jboss-ejb-client MAVEN version =1.0.0.Beta12, =6.0-2, =4.1, =4.1, =1.0.1, =0.1.0, =0.1.0, =2.2, =8.0, =8.0, =0.2.4, =1.0.0.Alpha3, =0.1.0, =0.1.0, =0.12.0.Final, =1.0.0.CR2 and more Source cves: CVE-2020-14297 Source advisory: OSV:GHSA-QCCH-9268-59JW...
Ignite Realtime Openfire vulnerable to Server Side Request Forgery
A Server Side Request Forgery SSRF vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests. The issue is fixed in version 4.5.0-beta...
GHSA-MFJW-X4Q4-69P9 Ignite Realtime Openfire vulnerable to Server Side Request Forgery
A Server Side Request Forgery SSRF vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests. The issue is fixed in version 4.5.0-beta...