User confusion in IronJacamar

The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to obtain access to an arbitrary datasource...

com.alibaba.csp:sentinel-datasource-nacos (1.3.1), com.alibaba.csp:sentinel-demo-nacos-datasource (1.3.1) +4 more potentially affected by CVE-2021-44667 via com.alibaba.nacos:nacos-common (0.4.0)

com.alibaba.nacos:nacos-common MAVEN version 0.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 1.3.1 - com.alibaba.csp:sentinel-demo-nacos-datasource...

com.alibaba.csp:sentinel-datasource-nacos (1.4.0), com.alibaba.nacos:nacos-client (0.2.1) potentially affected by CVE-2021-44667 via com.alibaba.nacos:nacos-common (0.2.1)

com.alibaba.nacos:nacos-common MAVEN version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 1.4.0 - com.alibaba.nacos:nacos-client 0.2.1 Source cves:...

Cross site scripting

Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting XSS attack. The...

CVE-2022-21702 Cross site scripting in Grafana proxy

Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting XSS attack. The...

CVE-2022-21702

Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting XSS attack. The...

CVE-2022-21702 Cross site scripting in Grafana proxy

Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting XSS attack. The...

XSS in Proxy in Grafana

Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting XSS attack. The...

CVE-2022-21702: Improper Neutralization of Input During Web Page Generation

Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting XSS attack. The...

PT-2022-6560

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description The issue allows an attacker to serve HTML content through the Grafana datasource or plugin proxy, tricking a user into visiting a specially crafted HTML page and executing a Cross-site...

Remote Code Execution (RCE)

org.apache.kylin:kylin-datasource-sdk is vulnerable to remote code execution. A remote attacker is able to inject and execute malicious code from a hacker-controlled malicious MySQL server within Kylin server processes because the library allows users to read data from other database systems usin...

UBUNTU-CVE-2021-43815

Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source enabled and configured. The vulnerabili...

GHSA-R695-7VR9-JGC2 Unsafe Deserialization in jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource...

GHSA-H3CW-G4MQ-C5X2 Code Injection in jackson-databind

This project contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource aka Anteros-DBCP...

wolfmqtt:wolfmqtt-fuzzer: Crash in __cxxabiv1::__aligned_malloc_with_fallback

Project: https://github.com/wolfSSL/wolfMQTT.git Detailed Report: https://oss-fuzz.com/testcase?key=5192141639385088 Project: wolfmqtt Fuzzing Engine: libFuzzer Fuzz Target: wolfmqtt-fuzzer Job Type: libfuzzerubsanwolfmqtt Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7ff300000018...

com.alibaba.csp:sentinel-datasource-nacos (>=0.1.1, <=0.1.2), com.alibaba.csp:sentinel-demo-nacos-datasource (>=0.1.1, <=0.1.2) +6 more potentially affected by CVE-2020-19676 via com.alibaba.nacos:nacos-common (0.1.0)

com.alibaba.nacos:nacos-common MAVEN version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos =0.1.1, =0.1.1, =3.4.7, =3.4.0, =3.7.0, =3.4.0, =3.7.0,...

com.alibaba.csp:sentinel-datasource-nacos (1.3.0-ga), com.alibaba.nacos:nacos-client (0.3.0) +9 more potentially affected by CVE-2020-19676 via com.alibaba.nacos:nacos-common (0.3.0)

com.alibaba.nacos:nacos-common MAVEN version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 1.3.0-ga - com.alibaba.nacos:nacos-client 0.3.0 -...

com.alibaba.csp:sentinel-datasource-nacos (1.4.0), com.alibaba.nacos:nacos-client (0.2.1) potentially affected by CVE-2020-19676 via com.alibaba.nacos:nacos-common (0.2.1)

com.alibaba.nacos:nacos-common MAVEN version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 1.4.0 - com.alibaba.nacos:nacos-client 0.2.1 Source cves:...

com.alibaba.csp:sentinel-datasource-nacos (1.4.1), com.alibaba.nacos:nacos-client (0.6.2) +13 more potentially affected by CVE-2020-19676 via com.alibaba.nacos:nacos-common (0.6.2)

com.alibaba.nacos:nacos-common MAVEN version 0.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 1.4.1 - com.alibaba.nacos:nacos-client 0.6.2 -...

wolfmqtt:wolfmqtt-fuzzer: Dynamic-stack-buffer-overflow in fuzzing::datasource::Datasource::get

Project: https://github.com/wolfSSL/wolfMQTT.git Detailed Report: https://oss-fuzz.com/testcase?key=5948192591052800 Project: wolfmqtt Fuzzing Engine: afl Fuzz Target: wolfmqtt-fuzzer Job Type: aflasanwolfmqtt Platform Id: linux Crash Type: Dynamic-stack-buffer-overflow WRITE Crash Address:...