12960 matches found
vaadin:flow-server 安全漏洞
Vaadin flow is a software application.The Vaadin platform is a Java framework for building modern websites that look great, perform well and keep you and your users happy. A security vulnerability exists in vaadin:flow-server that stems from a URL encoding error in the development mode handler. T...
GHSA-4HQ8-GMXX-H6W9 XML Processing error in github.com/crewjam/saml
Impact There are three vulnerabilities in the go encoding/xml package that can allow an attacker to forge part of a signed XML document. For details on this vulnerability see xml-roundtrip-validator Patches In version 0.4.3, all XML input is validated prior to being parsed...
XML Processing error in github.com/crewjam/saml
Impact There are three vulnerabilities in the go encoding/xml package that can allow an attacker to forge part of a signed XML document. For details on this vulnerability see xml-roundtrip-validator Patches In version 0.4.3, all XML input is validated prior to being parsed...
Medium: libxml2
Issue Overview: GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e. CVE-2020-24977 There is a flaw in the xml entity encoding functionality of libxml2. An attacker who is able to...
OESA-2021-1231 resteasy security update
%global desc \ RESTEasy contains a JBoss project that provides frameworks to help\ build RESTful Web Services and RESTful Java applications. It is a fully\ certified and portable implementation of the JAX-RS specification. \ %global extdesc \ \ This package contains Security Fixes: A cross-site...
HTTP Request Smuggling in netius
netius prior to 1.17.58 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Transfer encoding header parsing which could allow for CL:TE or TE:TE attacks...
GHSA-WM2M-XRRP-J74C HTTP Request Smuggling in netius
netius prior to 1.17.58 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Transfer encoding header parsing which could allow for CL:TE or TE:TE attacks...
The vulnerability of the libwebp library lies in its ability to allow arbitrary code execution during image encoding and decoding in the WebP format. This vulnerability stems from the use of memory after the library is freed, which enables attackers to execute arbitrary code.
The vulnerability of the libwebp library for encoding and decoding WebP images is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code by creating a specially crafted file...
The vulnerability of the libwebp library regarding the encoding and decoding of WebP images, which involves reading beyond the buffer in memory, allows attackers to access confidential information.
The vulnerability of the libwebp library for encoding and decoding WebP images is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to gain access to confidential information by creating a specially crafted file...
The vulnerability of the libwebp library regarding the encoding and decoding of WebP images, which involves reading beyond the buffer in memory, allows attackers to access confidential information.
The vulnerability of the libwebp library for encoding and decoding WebP images is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to gain access to confidential information by creating a specially crafted file...
The vulnerability of the libwebp library lies in its ability to encode and decode WebP images, which involves the use of an uninitialized variable. This allows attackers to execute arbitrary code.
The vulnerability of the libwebp library for encoding and decoding WebP images is related to the use of an uninitialized variable. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
The vulnerability of the libwebp library regarding the encoding and decoding of WebP images, which involves reading beyond the buffer in memory, allows attackers to access confidential information.
The vulnerability of the libwebp library for encoding and decoding WebP images is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to gain access to confidential information by creating a specially crafted file...
The vulnerability of the libwebp library regarding the encoding and decoding of WebP images allows for uncontrolled resource consumption, enabling attackers to cause service failures.
The vulnerability of the libwebp library for encoding and decoding WebP images is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...
The vulnerability of the libwebp library regarding the encoding and decoding of WebP images, which is related to buffer overflow in the “heap”, allows attackers to execute arbitrary code.
The vulnerability of the libwebp library for encoding and decoding WebP images is related to buffer overflow in the “bucket” mechanism. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code by creating a specially crafted file...
Linux/x86 Custom Shellcode ASCII And-Sub Encoder
/ Title: Linux/x86 - Custom Shellcode ASCII And-Sub Encoder Date: 29.03.2021 Author: Xenofon Vassilakopoulos github : https://github.com/xen0vas/ASCII-AND-SUB-Encoder gcc -m32 sub.c -o sub Usage : ./sub -s \x41\xff\x41\x41 -b \x0a\x0d\x2f\x3a\x3f\x40\x80\x81\x82 / include include include include...
GHSA-29QJ-RVV6-QRMV Cross-site scripting in RESTEasy
A cross-site scripting XSS flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack...
Cross-site scripting in RESTEasy
A cross-site scripting XSS flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack...
Fixed in Apache Tomcat 8.5.68
Note: The issue below was fixed in Apache Tomcat 8.5.67 but the release vote for the 8.5.67 release candidate did not pass. Therefore, although users must download 8.5.68 to obtain a version that includes a fix for this issue, version 8.5.67 is not included in the list of affected versions...
PT-2021-3586
Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 8.5.0 through 8.5.66 Apache Tomcat versions 9.0.0.M1 through 9.0.46 Apache Tomcat versions 10.0.0-M1 through 10.0.6 Description The issue is related to the incorrect parsing of the HTTP transfer-encoding request header i...
The vulnerability of the client’s execution file airhost.exe allows unauthorized access to protected information when conducting real-time audio and video conferences using Zoom Client for Meetings.
The vulnerability of the airhost.exe executable file used by clients for real-time audio and video conferencing with Zoom Client for Meetings is related to the rigid encoding of registration data when using the SHA-256 hashing algorithm. Exploiting this vulnerability can allow a malicious...