13009 matches found
Code injection
In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new users would have access to the Script Console within their private space...
CVE-2022-2013
The CVE-2022-2013 issue affects Octopus Server versions after 2022.1.1495 and before 2022.1.2647. If private spaces are enabled via the experimental feature flag, all new users could access the Script Console within their private space, indicating an exposure of scripting capabilities to unintend...
Octopus Server 安全漏洞
Octopus Server is an automated deployment platform. A security vulnerability exists in Octopus Server versions after 2022.1.1495 and before 2022.1.2647, which stems from the fact that all new users can access the scripting console within their private space if private space is enabled via the...
The vulnerability of the EAS Console component of the Oracle Hyperion Essbase Administration Services service allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the EAS Console component of the Oracle Hyperion Essbase Administration Services exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information through...
Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.5 security updates, images, and bug fixes
Red Hat Advanced Cluster Management for Kubernetes 2.5.0 is now generally available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
The vulnerability of microprogramming software in embedded access controllers of Dell’s iDRAC9 system, related to authentication procedures that allow unauthorized access to the VNC console.
The vulnerability of the microprogramming software in embedded remote access controllers of Dell iDRAC9 is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to gain access to the console via VNC...
nodejs: Prototype pollution via console.table properties
Due to the formatting logic of the "console.table" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "proto". The prototype pollution has...
h2: Loading of custom classes from remote servers through JNDI
A flaw was found in the H2 Console. This flaw allows remote attackers to execute arbitrary code via a JDBC URL, concatenating with a substring that allows remote code execution by using a script...
h2: Remote Code Execution in Console
A flaw was found in h2. The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. This flaw allows an attacker to use this URL to send another server’s code, causing remote code execution. This issue is exploited...
h2: Remote Code Execution in Console
A flaw was found in h2. The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. This flaw allows an attacker to use this URL to send another server’s code, causing remote code execution. This issue is exploited...
h2: Loading of custom classes from remote servers through JNDI
A flaw was found in the H2 Console. This flaw allows remote attackers to execute arbitrary code via a JDBC URL, concatenating with a substring that allows remote code execution by using a script...
h2: Loading of custom classes from remote servers through JNDI
A flaw was found in the H2 Console. This flaw allows remote attackers to execute arbitrary code via a JDBC URL, concatenating with a substring that allows remote code execution by using a script...
h2: Remote Code Execution in Console
A flaw was found in h2. The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. This flaw allows an attacker to use this URL to send another server’s code, causing remote code execution. This issue is exploited...
nodejs: Prototype pollution via console.table properties
Due to the formatting logic of the "console.table" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "proto". The prototype pollution has...
[SECURITY] Fedora 35 Update: dotnet3.1-3.1.419-1.fc35
.NET Core is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET Core contains a runtime conforming to .NET Standards a set of...
Logic Flaw Vulnerability in BES Management Console of Beijing Bowland Software Co. Ltd (CNVD-2022-48625)
Beijing Bowland Software Co., Ltd. is a high-tech software enterprise specializing in the development and promotion of basic software. A logic flaw vulnerability exists in the BES management console of Beijing Bowland Software Co., Ltd, which can be exploited by attackers to obtain sensitive...
How to Manually Update Veeam Backup Agent Deployment Packages on Veeam Service Provider Console Server
When the Veeam Service Provider Console server does not have internet access it is unable to download the latest deployment packages for Veeam Backup Agents i.e., Veeam Agent for Microsoft Windows, Veeam Agent for Linux, Veeam Agent for Mac from the Veeam Installation Server...
PUB-A-197154898
In getinbuf and controlworkhandler of virtioconsole.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation...
Splunk Enterprise 8.1 < 8.1.4 XSS
According to its self-reported version number, the version of Splunk running on the remote web server is Splunk Enterprise 8.1.x prior to 8.1.4 It may, therefore, be affected by a reflected XSS vulnerability. The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in ...
