PT-2023-9752

Name of the Vulnerable Software and Affected Versions Mozilla Convict versions prior to 6.2.4 Description The issue is related to improperly controlled modification of object prototype attributes, also known as "prototype pollution." This allows an attacker to inject attributes that are used in...

kubernetes security update

kubernetes 1.21.14-3 - Addresses CVE-2022-3294 & CVE-2022-3162 1.21.14-2 - Fixed kubernetes-cni version. 1.21.14-1 - Addresses CVE-2022-3172 olcne 1.4.9-2 - Fix 1.21 kubernetes version to align with last upstream release 1.4.9-1 - Resolve kubernetes CVE-2022-3294 & CVE-2022-3162 for version 1.21...

CVE-2022-41958

super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. This issue has been addressed in commit "4d0d5966" and will ...

CVE-2022-26885 Apache DolphinScheduler config file read by task risk

When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher...

CVE-2022-26885 Apache DolphinScheduler config file read by task risk

When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher...

CVE-2022-26885: Exposure of Sensitive Information to an Unauthorized Actor

When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher...

D-Link DIR-1935 ConfigFileUpload Code Execution

The vulnerability of the ConfigFileUpload function in the web interface for managing D-Link DIR-1935 router microprogramming software is related to the use of uncontrolled format strings. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Jenkins Config File Provider Plugin External Entity Injection (CVE-2021-21642)

An XXE vulnerability exists in Jenkins Config File Provider Plugin. The vulnerability is due to insufficient validation of XML data when utilizing Config File Provider Plugin...

CVE-2022-44725

OPC Foundation Local Discovery Server LDS through 1.04.403.478 uses a hard-coded file path to a configuration file. This allows a normal user to create a malicious file that is loaded by LDS running as a high-privilege user...

PT-2022-6840 · Opc Foundation · Opc Foundation Local Discovery Server

Name of the Vulnerable Software and Affected Versions: OPC Foundation Local Discovery Server LDS versions 1.04.403.478 and earlier Description: The issue is related to the incorrect assignment of permissions for a critical resource in the Local Discovery Server LDS of the Siemens software. This...

Powercom UPSMON PRO 安全漏洞

Powercom UPSMON PRO is a multi-platform client-server software from Powercom that allows remote monitoring and control of UPS via SNMP, HTTP and UDP. A security vulnerability exists in Powercom UPSMON PRO, which is caused by a configuration file that stores user passwords in clear text in the...

Arbitrary Code Execution

jupytercore is vulnerable to arbitrary code execution. The vulnerability exists in the configfilepaths function in application.py which executes untrusted files in the current working directory, allowing one user to run code as another...

configuration file implementation of Code Execution

The vulnerability of the configuration file implementation of the Hitachi Energy MicroSCADA X SYS600 software for equipment monitoring and control exists due to insufficient verification of input data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute...

haproxy:fuzz_cfg_parser: Heap-buffer-overflow in parse_line

Project: https://github.com/haproxy/haproxy.git Detailed Report: https://oss-fuzz.com/testcase?key=4952538231472128 Project: haproxy Fuzzing Engine: afl Fuzz Target: fuzzcfgparser Job Type: aflasanhaproxy Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x619000000b14 Cra...

DEBIAN-CVE-2022-3287

When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file...

CVE-2022-41232

A cross-site request forgery CSRF vulnerability in Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers to replace any config.xml file on the Jenkins controller file system with an empty file by providing a crafted file name to an API endpoint...

dbus-broker security update

28-5.1 - Fix a stack buffer over-read in the c-shquote library - Fix null pointer reference when supplying a malformed XML config file - Add gating.yaml Resolves: CVE-2022-31212 Resolves: CVE-2022-31213...

PT-2022-25762 · Jenkins · Jenkins Bigpanda Notifier Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins BigPanda Notifier Plugin versions 1.4.0 and earlier Description: The issue concerns the storage of the BigPanda API key in an unencrypted form within the global configuration file on the Jenkins controller. This file can be accessed b...

Jenkins CONS3RT Plugin 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

dbus-broker: null pointer reference when supplying a malformed XML config file

A flaw was found in the dbus-broker package. This issue occurs when supplying a malformed XML config file and leads to a NULL pointer dereference...