9175 matches found
karaf: path traversal flaws
A flaw was found in the Apache Karaf obr: command, where a partial path traversal issue allows a break out of the expected folder. This entry is set by the user...
springframework: malicious input leads to insertion of additional log entries
In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries...
CVE-2022-34007
EQS Integrity Line Professional through 2022-07-01 allows a stored XSS via a crafted whistleblower entry...
CVE-2022-34007
EQS Integrity Line Professional through 2022-07-01 allows a stored XSS via a crafted whistleblower entry...
CVE-2022-34007
EQS Integrity Line Professional through 2022-07-01 allows a stored XSS via a crafted whistleblower entry...
Cross site scripting
EQS Integrity Line Professional through 2022-07-01 allows a stored XSS via a crafted whistleblower entry...
CVE-2022-34007
EQS Integrity Line Professional through 2022-07-01 allows a stored XSS via a crafted whistleblower entry...
CVE-2022-34007
CVE-2022-34007 affects EQS Integrity Line (Professional) through 2022-07-01 with a stored XSS via a crafted whistleblower entry. The root cause is a stored cross-site scripting vulnerability; exploitation details are not provided in the documents. Red Hat, CNVD, NVD and third-party advisories cor...
PT-2022-21963 · Eqs · Eqs Integrity Line
Name of the Vulnerable Software and Affected Versions: EQS Integrity Line through 2022-07-01 Description: The issue allows a stored XSS via a crafted whistleblower entry. Recommendations: For EQS Integrity Line through 2022-07-01, consider restricting access to the whistleblower entry feature unt...
RUSTSEC-2022-0101 Miscompilation of constant values in division on AArch64
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7f6x-jwh5-m9r4. For more information see the GitHub-hosted security advisory...
CVE-2022-33016
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none...
The vulnerability of the _nc_parse_entry function in the terminal input/output library parse_entry.c allows a attacker to cause a service failure.
The vulnerability of the ncparseentry function in the terminal input/output library’s source file parseentry.c is related to the use of a null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure by using a specially created file...
CVE-2022-2246
DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage...
CVE-2022-31084 Unauthenticated Remote Code Execution in ldap-account-manager
LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument. This can lead to cod...
CVE-2022-1845
The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged in admin delete plugin's data, update the settings, add new entries and more via CSRF attacks...
CVE-2022-30932
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
Malicious Package
Overview @kraken-frontend/entry-point is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...
ROS-20220622-01
Vulnerability of the E2fsprogs service utility set is related to a boundary error when processing unreliable input data. Exploitation of the vulnerability could allow an attacker to exploit a specially crafted file system, run an out-of-bounds entry, and execute arbitrary code on the target syste...