CVE-2022-28168

In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored using Base64 encoding, which could allow an attacker able to access log files to easily decode the passwords...

CVE-2022-28168

In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored using Base64 encoding, which could allow an attacker able to access log files to easily decode the passwords...

Code injection

In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored using Base64 encoding, which could allow an attacker able to access log files to easily decode the passwords...

CVE-2022-28168

In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored using Base64 encoding, which could allow an attacker able to access log files to easily decode the passwords...

Insecure Signature Verification

jsrsasign is vulnerable to insecure signature verification. The vulnerability exists because the library does not properly validate the JWS or JWT signature with non-Base64URL encoding special characters or number escaped characters such as !@$% or \11...

GHSA-3FVG-4V2M-98JF JWS and JWT signature validation vulnerability with special characters

Impact Jsrsasign supports JWSJSON Web Signatures and JWTJSON Web Token validation. However JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. For example, even if a string of non Base64URL encoding characters such...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the password reset functionality where a malicious actor can send fake password reset email to arbitrary victim. Remediation Upgrade motor-admin to version 0.2.61 or higher. References - GitHub...

EulerOS 2.0 SP8 : golang (EulerOS-SA-2022-1930)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data. CVE-2022-24675 - The gener...

UBUNTU-CVE-2014-125006

A vulnerability, which was classified as problematic, has been found in FFmpeg 2.0. Affected by this issue is the function outputframe of the file libavcodec/h264.c. The manipulation leads to memory corruption. The attack may be launched remotely. It is recommended to apply a patch to fix this...

Uncontrolled Resource Consumption in @discordjs/opus

Improperly handled errors in @discordjs/opus cause hard crashes instead of returning the error to user land. All versions of package @discordjs/opus = 0.7.0 are vulnerable to Denial of Service DoS when trying to encode using an encoder with zero channels, or a non-initialized buffer. This leads t...

@discordjs/opus 安全漏洞

@discordjs/opus is an open source native binding of discord.js to libopus v1.3. A security vulnerability exists in @discordjs/opus that stems from the vulnerability of this package to denial-of-service DoS attacks when attempting to encode with an encoder that has a zero-channel or an uninitializ...

EulerOS 2.0 SP5 : golang (EulerOS-SA-2022-1890)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to...

Microsoft HEVC Video Extensions Remote Code Execution Vulnerability (CNVD-2022-59678)

Microsoft HEVC Video Extensions is a video extension application from Microsoft Corporation USA. The application enables computers and devices to read High Efficiency Video Encoding or HEVC video. Microsoft HEVC Video Extensions has a remote code execution vulnerability and no details of the...

Adobe Media Encoder Memory Corruption Vulnerability (CNVD-2022-50236)

Adobe Media Encoder is an audio and video encoding application from the American company Audobee Adobe. A memory corruption vulnerability exists in Adobe Media Encoder version 15.4 and earlier versions, which can be exploited by an attacker to execute arbitrary code in the context of the current...

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL making it a *different* URL usingthe wrong host name when it is later retrieved.For example a URL like `http://example.com%2F127.0.0.1/` would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters checks and more.

...

Gshell - A Flexible And Scalable Cross-Plaform Shell Generator Tool

A simple yet flexible cross-platform shell generator tool. Name: GGreat Shell Description: A cross-platform shell generator tool that lets you generate whichever shell you want, in any system you want, giving you full control and automation. If you find this tool helpful, then please give me a...

PT-2022-20487 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 9.5.34 ELTS TYPO3 versions prior to 10.4.29 TYPO3 versions prior to 11.5.11 Description: The issue concerns user-submitted content not being properly encoded in HTML emails sent to users. The affected components are ma...

semantic-release 信息泄露漏洞

semantic-release is semantic-release open source for automating the entire package release workflow, including: determining the next version number, generating release notes and releasing packages. An information disclosure vulnerability exists in semantic-release version 17.0.4, which stems from...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-41773 CVE-2021-41773 According to The National Vulne...

CVE-2020-6220

BI Launchpad and CMC in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. Exploit is possible only when the bttoken in victim’s session is active...