17058 matches found
The vulnerability of the pre-processing processor Simcenter Femap, caused by buffer overflow in dynamic memory, allows a hacker to execute code within the context of the current process.
The vulnerability of the pre-processing processor Simcenter Femap arises due to an overflow in the buffer in the dynamic memory. Exploiting this vulnerability allows a malicious actor to execute code within the context of the current process while analyzing specially created NEU files...
GHSA-V4VM-GJ2X-6QHM DCE extension for Typo3 Discloses Environment Information
The default configuration in the Dynamic Content Elements dce extension before 0.11.5 for TYPO3 allows remote attackers to obtain sensitive installation environment information by reading the update check request...
GHSA-56F8-G68R-J699 Cross-site Scripting in Apache Struts
Multiple Cross-Site Scripting XSS in XWork generated error pages in Apache Struts. By default, XWork doesn't escape action's names in automatically generated error page, allowing for a successful XSS attack. When Dynamic Method Invocation DMI is enabled, the action name is generated dynamically...
Cross-site Scripting in Apache Struts
Multiple Cross-Site Scripting XSS in XWork generated error pages in Apache Struts. By default, XWork doesn't escape action's names in automatically generated error page, allowing for a successful XSS attack. When Dynamic Method Invocation DMI is enabled, the action name is generated dynamically...
Improperly Controlled Modification of Dynamically-Determined Object Attributes
Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the SERVER superglobal array. An attacker can overwrite entries in this array by sending crafted POST parameters. Remediation Upgrade com.caucho:resin to...
Elasticsearch Improper Access Control vulnerability
The default configuration in Elasticsearch before 1.4.0.Beta1 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. NOTE: this only violates the vendor's intended security policy if the user does not run...
GHSA-MRFM-JXGF-2H6V Elasticsearch Improper Access Control vulnerability
The default configuration in Elasticsearch before 1.4.0.Beta1 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. NOTE: this only violates the vendor's intended security policy if the user does not run...
Code injection in Apache Struts
Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors...
GHSA-J7H6-XR7G-M2C5 Code injection in Apache Struts
Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors...
The vulnerability of the Adobe Animate software for creating multimedia and computer animations arises from a buffer overflow in the dynamic memory, allowing an attacker to execute arbitrary code.
The vulnerability of the Adobe Animate software for creating multimedia and computer animations arises due to an overflow in the dynamic memory buffer. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created file...
Crafter CMS 安全漏洞
Crafter CMS is an open source content management system CMS for digital experience applications. A security vulnerability exists in Crafter CMS's Crafter Studio that stems from improper control of dynamically managed code resources. An attacker could exploit the vulnerability to execute operating...
Apache Struts vulnerable to arbitrary remote code execution due to improper input validation
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! exclamation mark operator to the REST Plugin...
GHSA-MMJ6-CJJ4-HPR5 Apache Struts vulnerable to arbitrary remote code execution due to improper input validation
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! exclamation mark operator to the REST Plugin...
Apache Struts RCE Vulnerability
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions...
Installer of Trend Micro HouseCall for Home Networks may insecurely load Dynamic Link Libraries
Overview Trend Micro Incorporated has released a security update for HouseCall for Home Networks. Trend Micro Incorporated reported this vulnerability to JPCERT/CC to notify users of the solution through JVN. Impact Installer of Trend Micro HouseCall for Home Networks contains an issue with the D...
GHSA-9V72-P5P3-9W65 Exposure of Sensitive Information to an Unauthorized Actor in Jenkins-mailer-plugin
jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically created list of users based on the changelogs. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in ra...
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to execute arbitrary code.
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine arises due to an overflow in the dynamic memory buffer. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability in the API for working with computer graphics in WebGPU browsers like Google Chrome and Microsoft Edge allows attackers to execute arbitrary code.
The vulnerability of the API for working with computer graphics in WebGPU browsers like Google Chrome and Microsoft Edge is due to a buffer overflow in the dynamic memory. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...
The vulnerability in the implementation of browser interface settings for Google Chrome and Microsoft Edge allows a hacker to execute arbitrary code.
The vulnerability of the Chrome and Microsoft Edge browser interface settings is caused by a buffer overflow in dynamic memory. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...
