Google Chrome 资源管理错误漏洞

Google Chrome is a web browser from Google, an American company. A resource management error vulnerability previously existed in Google Chrome version 93.0.4577.82, which stemmed from the presence of Blink free after use. An attacker could exploit the vulnerability to cause a denial of service wi...

The vulnerability of the Local Security Authority (LSA) service in the Windows operating system allows a perpetrator to trigger a service failure.

The vulnerability of the Local Security Authority LSA service in the Microsoft Windows operating system is related to insufficient input validation. Exploiting this vulnerability can allow a malicious actor to trigger a service failure through a specially crafted request...

The vulnerability of the HTTP.sys driver in the Microsoft Windows operating system, which allows a hacker to trigger a service failure

The vulnerability of the HTTP.sys driver in the Microsoft Windows operating system is related to insufficient input validation. Exploiting this vulnerability can allow a malicious actor to trigger a service failure through a specially crafted request...

CVE-2022-31457

RTX TRAP v1.0 allows attackers to perform a directory traversal via a crafted request sent to the endpoint /data/...

CVE-2022-31457

RTX TRAP v1.0 allows attackers to perform a directory traversal via a crafted request sent to the endpoint /data/...

Directory traversal

RTX TRAP v1.0 allows attackers to perform a directory traversal via a crafted request sent to the endpoint /data/...

CVE-2023-38493 Paths contain matrix variables bypass decorators

Armeria is a microservice framework Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via TomcatService or JettyService with the path that may contain matrix variables. Prior to version 1.24.3, the Armeria decorators might not invoked because of t...

Security Bulletin: IBM Event Streams is affected by multiple vulnerabilities in Golang Go

Summary Vulnerabilities in golang before 1.19.10 affect the golang component that is used by IBM Event Streams CVE-2023-29402, CVE-2023-29403, CVE-2023-29404, CVE-2023-29405. These vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2023-29403 DESCRIPTION: Golang Go could allow a...

CVE-2022-31457

RTX TRAP v1.0 allows attackers to perform a directory traversal via a crafted request sent to the endpoint /data/...

CVE-2022-31457

RTX TRAP v1.0 allows attackers to perform a directory traversal via a crafted request sent to the endpoint /data/...

CVE-2023-36339

An access control issue in WebBoss.io CMS v3.7.0.1 allows attackers to access the Website Backup Tool via a crafted GET request...

CVE-2023-36339

An access control issue in WebBoss.io CMS v3.7.0.1 allows attackers to access the Website Backup Tool via a crafted GET request...

Dapr 授权问题漏洞

Dapr is a portable, serverless, event-driven runtime from the Dapr open source. Dapr suffers from an authorization issue vulnerability that stems from allowing bypassing API token authentication, where an attacker can authenticate calls from the application via a carefully crafted HTTP request...

The vulnerabilities of the microprogrammed software of TP-Link routers such as TL-WR940N V2/V4/V6, TL-WR841N V8/V10, and TL-WR941ND V5 allow attackers to cause service failures.

The vulnerability of the microprogrammed software of TP-Link routers such as TL-WR940N V2/V4/V6, TL-WR841N V8/V10, and TL-WR941ND V5 is related to errors in resource release. Exploiting this vulnerability allows a malicious actor to trigger a service failure using a specially created GET request...

The vulnerability of the IBM InfoSphere Information Server software platform, related to insufficient protection of operational data, allows attackers to gain unauthorized access to protected information.

The vulnerability of the IBM InfoSphere Information Server software platform is related to insufficient protection for operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information by sending a specially crafted...

CVE-2023-32761

Cross Site Request Forgery CSRF vulnerability in Archer Platform before v.6.13 and fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to execute arbitrary code via a crafted request...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF vulnerability in Archer Platform before v.6.13 and fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to execute arbitrary code via a crafted request...

Apache Airflow Security Bypass Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A security bypass vulnerability exists in Apache Airflow versions prior to 2.6.3,...

CVE-2023-37565

Code injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute arbitrary code by sending a specially crafted request. Affected products and versions are as follows: WRC-1167GHBK-S v1.03 and earlier, WRC-1167GEBK-S v1.03 and earlier,...

CVE-2023-37564

OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute an arbitrary OS command with a root privilege by sending a specially crafted request. Affected products and versions are as follows: WRC-1167GHBK-S v1.03 and earlier,...