SQLFluff - A SQL Linter And Auto-Formatter For Humans

SQLFluff is a dialect-flexible and configurable SQL linter. Designed with ELT applications in mind, SQLFluff also works with jinja templating and dbt. SQLFluff will auto-fix most linting errors, allowing you to focus your time on what matters. Getting Started To get started, install the package a...

Improper Privilege Management in dolibarr/dolibarr

💥 BUG unprivileged user can attach agenda with leave. 💥 IMPACT user who dont have any access in leave can add agenda to this leave 💥 TESTED VERSION dolibarr 14.0.0-beta 💥 STEP TO REPRODUCE 1. First goto admin account and add user B as normal user .\ Now give user B bellow permission for Agenda...

in dolibarr/dolibarr

💥 BUG unprivileged user can modify subject of a ticket 💥 IMPACT user with read-only permission can modify ticket subject 💥 TESTED VERSION dolibarr 14.0.0-beta 💥 STEP TO REPRODUCE 1. First goto admin account and add user B as normal user .\ Now give user B bellow permission for Ticket module ....

Improper Privilege Management in dolibarr/dolibarr

💥 BUG unprivileged user can download file of a agenda 💥 IMPACT user dont have access to specific agenda but still can download file uploaded to this agenda . 💥 TESTED VERSION dolibarr 14.0.0-beta 💥 STEP TO REPRODUCE 1. First goto admin account and add user B as normal user .\ Now give user B...

SUSE-SU-2021:1688-1 Security Beta update for Salt

This update fixes the following issues: salt: - Parsing Epoch out of version provided during pkg remove bsc1173692 - Fix issue parsing errors in ansiblegate state module - Prevent command injection in the snapper module bsc1185281 CVE-2021-31607 - Transactionalupdate: detect recursion in the...

CVE-2021-22140

Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue XXE in the App Search web crawler beta feature. Using this vector, an attacker whose website is being crawled by App Search could craft a malicious sitemap.xml to traverse the filesystem of t...

CVE-2021-22140

Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue XXE in the App Search web crawler beta feature. Using this vector, an attacker whose website is being crawled by App Search could craft a malicious sitemap.xml to traverse the filesystem of t...

CVE-2021-22140

Elastic App Search (web crawler beta) versions 7.11.0–7.12.0 are affected by an XML External Entity (XXE) injection in the crawler, allowing an attacker crawling the site via a manipulated sitemap.xml to read files on the host. Root cause: insufficient validation of XML in the crawler. Impact: po...

OESA-2021-1167 OpenEXR security update

OpenEXR is a high dynamic-range HDR image file format originally developed by Industrial Light & Magic for use in computer imaging applications. Security Fixes: There's a flaw in OpenEXR in versions before 3.0.0-beta. A crafted input file that is processed by OpenEXR could cause a shift overflow ...

CVE-2021-20084

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' in jquery-sparkle 1.5.2-beta allows a malicious user to inject properties into Object.prototype...

Buffer overflow

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' in jquery-sparkle 1.5.2-beta allows a malicious user to inject properties into Object.prototype...

CVE-2021-20084

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' in jquery-sparkle 1.5.2-beta allows a malicious user to inject properties into Object.prototype...

CVE-2021-20084

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' in jquery-sparkle 1.5.2-beta allows a malicious user to inject properties into Object.prototype...

jquery-sparkle 安全漏洞

jquery-sparkle is an application. jQuery's "Don't Repeat Yourself" plugin/effects framework. A security vulnerability exists in jquery-sparkle 1.5.2-beta, which arises from an improperly controlled modification that allows a malicious user to inject properties into Object...

PT-2021-13762 · Unknown · Jquery-Sparkle

Name of the Vulnerable Software and Affected Versions: jquery-sparkle version 1.5.2-beta Description: The issue is related to 'Prototype Pollution' in the jquery-sparkle library, allowing a malicious user to inject properties into Object.prototype. Recommendations: For jquery-sparkle version...

VulnCheck KEV: CVE-2019-19597

D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters within an HNAPAUTH HTTP header...

PT-2021-7304 · Eclipse +2 · Eclipse Jetty +2

Name of the Vulnerable Software and Affected Versions: Eclipse Jetty versions 9.4.32 through 9.4.38 Eclipse Jetty versions 10.0.0.beta2 through 10.0.1 Eclipse Jetty versions 11.0.0.beta2 through 11.0.1 Description: The issue is related to the webapps directory in Eclipse Jetty being a symlink,...

AZL-44244 CVE-2021-3479 affecting package OpenEXR 2.3.0-6

There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger excessive consumption of memory, resulting in an impact to system availability...

DEBIAN-CVE-2021-3478

There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. An attacker able to submit a crafted file to be processed by OpenEXR could consume excessive system memory. The greatest impact of this flaw is to system availability...

CVE-2021-3479

There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger excessive consumption of memory, resulting in an impact to system availability...