3668 matches found
[SECURITY] Fedora 35 Update: golang-github-google-pprof-0-16.20210802gitc50bf4f.fc35
Pprof is a tool for visualization and analysis of profiling data. Pprof reads a collection of profiling samples in profile.proto format and generates reports to visualize and help analyze the data. It can generate both text and graphical reports through the use of the dot visualization package...
PT-2022-20574
Name of the Vulnerable Software and Affected Versions AWS SDK for Java versions prior to 1.12.261 Description A partial-path traversal issue exists within the downloadDirectory method in the AWS S3 TransferManager component of the AWS SDK for Java. This issue allows a knowledgeable actor to bypas...
campaignlab-com-dot-yamm-track.appspot.com Open Redirect vulnerability OBB-2726947
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2022-25898
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Validate JWS or JWT signature if it has...
GHSA-4CF5-XMHP-3XJ7 Improper Authorization in Apache Shiro
Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with . in the regular expression are possibly vulnerable to an authorization bypass...
CVE-2022-31237
Dell PowerScale OneFS, versions 9.2.0 up to and including 9.2.1.12 and 9.3.0.5 contain an improper preservation of permissions vulnerability in SyncIQ. A low privileged local attacker may potentially exploit this vulnerability, leading to limited information disclosure...
UBUNTU-CVE-2022-33108
XPDF v4.04 was discovered to contain a stack overflow vulnerability via the Object::Copy class of object.cc files...
Apache Shiro 安全漏洞
Apache Shiro is a Java security framework for performing authentication, authorization, encryption, and session management from the Apache Foundation.An authentication bypass vulnerability exists in Apache Shiro, which is caused when the RegexRequestMatcher method of privilege configuration is us...
dot.state.tx.us Cross Site Scripting vulnerability OBB-2672363
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2022-34174
In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm...
DEBIAN-CVE-2022-33067
Lrzip v0.651 was discovered to contain multiple invalid arithmetic shifts via the functions getmagic in lrzip.c and Predictor::init in libzpaq/libzpaq.cpp. These vulnerabilities allow attackers to cause a Denial of Service via unspecified vectors...
CVE-2021-41408
VoIPmonitor WEB GUI up to version 24.61 is affected by SQL injection through the "api.php" file and "user" parameter...
The vulnerability of the .NET components in the communication protocol library used for connecting components of ASU systems in the Triangle MicroWorks DNP3 Source Code Library platform for managing public distribution and transmission networks. This allows a intruder to cause a service failure.
The vulnerability of .NET components in the communication protocol library used for connecting components of ASU systems in the Triangle MicroWorks DNP3 Source Code Library platform for managing public distribution and transmission networks, such as Schneider Electric Saitel DP RTU Remote Termina...
CVE-2022-32547
In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and for type 'float', which requires 4 byte alignment at MagickCore/property.c. Whenever crafted or untrusted input is processed by ImageMagick, this causes a negative impact to application...
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.
...
Using its HSTS support curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL.
...
Microsoft .NET Core和Microsoft Visual Studio 安全漏洞
Microsoft Visual Studio and Microsoft .NET Core are both products of Microsoft Corporation. Microsoft Visual Studio is a family of development tool suites and a fundamentally complete set of development tools that includes most of the tools needed throughout the software lifecycle. Microsoft .NET...
PT-2022-7020 · Microsoft +4 · Net Core +10
Name of the Vulnerable Software and Affected Versions: .NET versions prior to 6.0.6 .NET Core versions prior to 3.1.26 NuGet versions prior to 6.2.1 NuGet.exe versions prior to 6.2.1 NuGet.Commands versions prior to 6.2.1 NuGet.CommandLine versions prior to 6.2.1 NuGet.CommandLine.XPlat versions...
Improper Verification of Cryptographic Signature
Overview jsrsasign is a free pure JavaScript cryptographic library. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid ...