2457 matches found
Security Bulletin: IBM UrbanCode Deploy (UCD) is vulnerable to denial of service due to Apache Tomcat (CVE-2023-28709)
Summary Apache Tomcat is used by IBM Urbancode Deploy UCD for processing web requests. Apache Tomcat is vulnerable to a denial of service, caused by an incomplete fix for CVE-2023-24998 related to the failure to limit the number of request parts to be processed in the file upload function. By...
Security Bulletin: IBM UrbanCode Deploy (UCD) is vulnerable to unsafe deserialization in SnakeYaml (CVE-2022-1471)
Summary SnakeYaml, a component of task execution, could allow an attacker to execute arbitrary code on the system by introducing specially-crafted yaml content. CVE-2022-1471 Vulnerability Details CVEID:CVE-2022-1471 DESCRIPTION: SnakeYaml could allow a remote authenticated attacker to execute...
PT-2023-8702 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 16.7.6 GitLab versions 16.8 through 16.8.2 GitLab versions 16.9 through 16.9.0 Description: An issue has been discovered in GitLab that allows group members with a sub-maintainer role to change the title of privately...
Password Disclosure
cloudfoundry is vulnerable to Password Disclosure. The vulnerability exists when kernel audit logging is enabled, which logs every command run on a VM, causing authentication commands of the form cf auth --client-credentials USERNAME PASSWORD to be logged in plaintext to syslog, allowing an...
When deploying a contract in PermissionlessNodeRegistry.deployNodeELRewardVault(), an attacker can find out in advance the address of the future deployed contract and deploy his own at this address
Lines of code Vulnerability details Impact The address of the new contract depends solely on the salt parameter, which is calculated from user-provided data. Once a user's create transaction is broadcast, the parameters for calculating salt can be viewed by anyone viewing the public mempool. This...
CVE-2023-33966
Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and denoruntime 0.114.0, outbound HTTP requests made using the built-in node:http or node:https modules are incorrectly not checked against the network permission allow list --allow-net. Dependencies relying on these built-in modules...
Design/Logic Flaw
Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and denoruntime 0.114.0, outbound HTTP requests made using the built-in node:http or node:https modules are incorrectly not checked against the network permission allow list --allow-net. Dependencies relying on these built-in modules...
CVE-2023-33966 Deno missing "--allow-net" permission check for built-in Node modules
Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and denoruntime 0.114.0, outbound HTTP requests made using the built-in node:http or node:https modules are incorrectly not checked against the network permission allow list --allow-net. Dependencies relying on these built-in modules...
CVE-2023-33966 Deno missing "--allow-net" permission check for built-in Node modules
Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and denoruntime 0.114.0, outbound HTTP requests made using the built-in node:http or node:https modules are incorrectly not checked against the network permission allow list --allow-net. Dependencies relying on these built-in modules...
CVE-2022-4870
In affected versions of Octopus Deploy it is possible to discover network details via error message...
CVE-2022-4870
In affected versions of Octopus Deploy it is possible to discover network details via error message...
CVE-2022-4870
In affected versions of Octopus Deploy it is possible to discover network details via error message...
Code injection
In affected versions of Octopus Deploy it is possible to discover network details via error message...
CVE-2022-4870
In affected versions of Octopus Deploy it is possible to discover network details via error message...
PT-2023-15886 · Unknown · Octopus Deploy
Name of the Vulnerable Software and Affected Versions: Octopus Deploy affected versions not specified Description: The issue allows discovery of network details via error messages in affected versions of the software. Recommendations: At the moment, there is no information about a newer version...
CVE-2022-4870
CVE-2022-4870 affects Octopus Deploy; the issue is information disclosure via error messages that reveal network details. The provided documents confirm the vulnerability is tied to Octopus Deploy and involve disclosure of network information through error output. Exploitation status is not detai...
CVE-2022-4870
In affected versions of Octopus Deploy it is possible to discover network details via error message...
Octopus Deploy 安全漏洞
Octopus Deploy is an automation tool for .NET, Java and other application development and deployment from Octopus Deploy Australia. A security vulnerability exists in Octopus Deploy that stems from the ability to discover network details via error messages...