3360 matches found
iTop Remote Command Execution Exploit
!/usr/bin/env ruby Exploit Title: iTop p...
Strapi 安全漏洞
Strapi is an open source content management system CMS. A security vulnerability in Strapi version 3.0 prior to version 3.6.9 and version 4.0 prior to version 4.0.0-beta.15 arises from a vulnerability in which an authenticated user with access to the Strapi admin panel can view private and...
Plone Cross-site scripting Vulnerability
Cross-site scripting XSS vulnerability in pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to "u,translate."...
GHSA-CQ5G-924M-7FXH Plone Information Disclosure
atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view without a name...
com.sksamuel.scruffy:scruffy-integrationtest_2.11 (=1.12.0), com.sksamuel.scruffy:scruffy-undertow_2.11 (>=1.9.0 <=1.12.0) +39 more potentially affected by CVE-2014-7816 via io.undertow:undertow-core (>=1.2.0.Beta1 <=1.2.0.Beta2)
io.undertow:undertow-core MAVEN version =1.2.0.Beta1, =1.9.0, =1.0.0.Alpha1, =1.2.0.Beta1, =1.2.0.Beta1, =1.2.0.Beta1, =0.5.1, =0.5.1, =1.0.0.Beta1, =1.0.0.Alpha9, =1.0.0.Beta1, =1.0.0.Beta1, =1.0.0.Beta1, =1.0.0.Beta1, =1.0.0.Beta1, =1.0.0.Beta4 and more Source cves: CVE-2014-7816 Source advisor...
at.porscheinformatik.zanata:common (>=4.7.0 <=4.7.8), at.porscheinformatik.zanata:stub-server (>=4.7.0 <=4.7.8) +337 more potentially affected by CVE-2016-6345 via org.jboss.resteasy:resteasy-client (>=3.0-beta-1 <=3.0.1.Final)
org.jboss.resteasy:resteasy-client MAVEN version =3.0-beta-1, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =1.1.11, =1.1.11, =1.3.2 and more Source cves: CVE-2016-6345 Source advisory: OSV:GHSA-VXHJ-3X7P-JXP5...
com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (=1.0.0), com.airbus-cyber-security.graylog:graylog-plugin-logging-alert (>=1.0.0 <=1.0.1) +8 more potentially affected by CVE-2018-11650 via org.graylog2:graylog2-server (>=1.0.0-beta.3 <=2.4.3)
org.graylog2:graylog2-server MAVEN version =1.0.0-beta.3, =1.0.0, =1.0.2, =2.2.0, =1.1.0, =2.2.0, =2.2.0, =1.0.3, =1.0.0, =1.2.0, =1.3.4 Source cves: CVE-2018-11650 Source advisory: OSV:GHSA-H7G4-65MF-6MXH...
GHSA-P6M5-X83R-HQMR Flarum Core Leaks PII
In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address...
GHSA-CXG2-49RQ-8GCR Apache Tomcat does not properly handle an invalid Transfer-Encoding header
Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service application outage or obtain sensitive information via a crafted header that interferes with "recycling...
GHSA-VC2V-34C4-VG9C Jenkins Fabric-beta-publisher Plugin stores credentials in plain text
Jenkins Fabric Beta Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...
GHSA-CCQF-C5HQ-77MP Missing Authorization in Apache ZooKeeper
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader...
Combodo iTop 跨站脚本漏洞
Combodo iTop is a French company Combodo ITIL-based development and for the daily operation of the IT environment of open source Web applications. The program provides incident management, configuration management, and problem management. A security vulnerability exists in Combodo iTop, which ste...
PT-2022-11369 · Comodo +1 · Itop +1
Name of the Vulnerable Software and Affected Versions: Combodo iTop versions 3.0.0 beta releases prior to beta6 Description: The issue concerns a web-based IT Service Management tool where the ajax.render.php?operation=wizard helper page did not properly escape user-supplied parameters, allowing...
CVE-2022-29281
Notable before 1.9.0-beta.8 doesn't effectively prevent the opening of executable files when clicking on a link. There is improper validation of the file URI scheme. A hyperlink to an SMB share could lead to execution of an arbitrary program or theft of NTLM credentials via an SMB relay attack,...
Input validation
Notable before 1.9.0-beta.8 doesn't effectively prevent the opening of executable files when clicking on a link. There is improper validation of the file URI scheme. A hyperlink to an SMB share could lead to execution of an arbitrary program or theft of NTLM credentials via an SMB relay attack,...
PT-2022-19521 · Notable +1 · Notable +1
Name of the Vulnerable Software and Affected Versions: Notable versions prior to 1.9.0-beta.8 Description: The issue arises from improper validation of the file URI scheme, allowing the opening of executable files when clicking on a link. This could lead to the execution of an arbitrary program o...
Grafana fine-grained access control API Key privilege escalation
Grafana is an open-source platform for monitoring and observability. When fine-grained access control is enabled and a client uses Grafana API Key to make requests, the permissions for that API Key are cached for 30 seconds for the given organization. Because of the way the cache ID is constructe...
PT-2022-16875 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions 2.8.2 and prior in the stable branch Discourse versions 2.9.0.beta3 and prior in the beta branch Discourse versions 2.9.0.beta3 and prior in the tests-passed branch Description: Discourse is an open source discussion...
Discourse 信息泄露漏洞
Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. Discourse is vulnerable to an information disclosure vulnerability that originates in the "stable" branch of version 2.8.2 and earlier, the "beta" branch of version 2.9.0.bet...