SUSE CVE-2022-30115

Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or th...

SUSE CVE-2022-30580

Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset...

xpdf 缓冲区错误漏洞

XPDF is an open source PDF reader from FOO Labs. The product supports decoding files in LZW compressed format and reading encrypted PDF files. XPDF 4.04 version of a security vulnerability , the vulnerability stems from xpdf/Dict.cc function there is a stack overflow vulnerability , a local...

CVE-2023-21722

.NET Framework Denial of Service Vulnerability...

PT-2023-1452 · Microsoft · .Net Framework

Name of the Vulnerable Software and Affected Versions: .NET Framework affected versions not specified Description: The issue is related to incorrect cleanup or release of resources in the .NET Framework, which can be exploited to cause a denial of service. This allows an attacker to affect the...

CVE-2023-24648

Zstore v6.6.0 was discovered to contain a cross-site scripting XSS vulnerability via the component /index.php...

Iranian OilRig Hackers Using New Backdoor to Exfiltrate Data from Govt. Organizations

The Iranian nation-state hacking group known as OilRig has continued to target government organizations in the Middle East as part of a cyber espionage campaign that leverages a new backdoor to exfiltrate data. "The campaign abuses legitimate but compromised email accounts to send stolen data to...

bootstrap: XSS in the data-target attribute

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041...

PT-2023-12661 · Unknown · Appium-Running +1

Name of the Vulnerable Software and Affected Versions: nemo-appium versions prior to 0.0.9 Description: The issue arises from improper input sanitization in the module.exports.setup function, leading to Command Injection. To exploit this, appium-running 0.1.3 must be installed as one of...

The vulnerability of the Oracle Data Provider for .NET component in the Oracle Database Server database management system allows a hacker to gain full control over the application.

The vulnerability of the Oracle Data Provider for .NET component in the Oracle Database Server database management system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain full control over the application using the TCPS protocol...

CVE-2022-43864

IBM Business Automation Workflow 22.0.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 239427...

RHEL 7 : rh-nodejs12-nodejs (RHSA-2020:5086)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5086 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...

CVE-2023-21841

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle...

PT-2023-13982 · Unknown · Blogengine.Net

Name of the Vulnerable Software and Affected Versions: BlogEngine.NET version 3.3.8.0 Description: The issue allows an attacker to create any folder with a files prefix under the /App Data/ directory. Recommendations: For BlogEngine.NET version 3.3.8.0, consider restricting access to the /App Dat...

PT-2023-8903

Name of the Vulnerable Software and Affected Versions Rack versions 2.0.0 through 2.0.9.1 Rack versions 2.1.0 through 2.1.4.1 Rack versions 2.2.0 through 2.2.4.0 Rack versions 3.0.0 through 3.0.0.0 Description A denial of service vulnerability in the multipart parsing component of Rack could allo...

CVE-2023-21538

.NET Denial of Service Vulnerability...

csv-interact (>=0.0.1, <=1.0.0), jb55-json2csv (>=3.0.0, <=3.1.1) +1 more potentially affected by CVE-2023-26106 via dot-lens (1.2.3)

dot-lens NPM version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on dot-lens and may be impacted: - csv-interact =0.0.1, =3.0.0, =3.1.1 - tableize-csv-parser 0.0.1 Source cves: CVE-2023-26106 Source advisory: SNYK:JS-DOTLENS-3227646...

Prototype Pollution

Overview dot-lens is a Simple, compiled dot lenses Affected versions of this package are vulnerable to Prototype Pollution via the set function in index.js file. PoC var dot = require"dot-lens" console.log"before:"+.test dot.set"proto.test","123" console.log"after:"+.test Details Prototype...

express 安全漏洞

express is expressjs open source a fast, unconstrained, minimalist web framework for Node.js. A security vulnerability exists in express version 0.x and earlier versions, which stems from improper handling of extra parameters...

Path Traversal

lite-dev-server is vulnerable to path traversal. The vulnerability exists in server.js because it aims to access files and directories that are stored outside the intended folder. By manipulating files with dot-dot-slash ../ sequences and its variations it may be possible to access arbitrary file...