2804 matches found
Traefik routes exposed with an empty TLSOption
Impact There is a potential vulnerability in Traefik managing the TLS connections. A router configured with a not well-formatted TLSOption is exposed with an empty TLSOption. For instance, a route secured using an mTLS connection set with a wrong CA file is exposed without verifying the client...
CVE-2022-34881
Generation of Error Message Containing Sensitive Information vulnerability in Hitachi JP1/Automatic Operation allows local users to gain sensitive information. This issue affects JP1/Automatic Operation: from 10-00 through 10-54-03, from 11-00 before 11-51-09, from 12-00 before 12-60-01...
PT-2022-22415 · Hitachi · Hitachi Jp1/Automatic Operation
Name of the Vulnerable Software and Affected Versions: Hitachi JP1/Automatic Operation versions 10-00 through 10-54-03 Hitachi JP1/Automatic Operation versions 11-00 through 11-51-08 Hitachi JP1/Automatic Operation versions 12-00 through 12-60-00 Description: The issue allows local users to gain...
PT-2022-27440 · Unknown · Human Resource Management System
Name of the Vulnerable Software and Affected Versions: Human Resource Management System version 1.0.0 Description: The Human Resource Management System contains a cross-site scripting XSS vulnerability. This issue is triggered via a crafted payload injected into an authentication error message...
Socketio Engine.IO Denial of Service Vulnerability
Engine.IO is a transport-based implementation of Socket.IO's cross-browser/cross-device bi-directional communication layer.A denial-of-service vulnerability exists in versions of Socketio Engine.IO prior to 3.6.1, 4.0.0 and later, and prior to 6.2.1, which stems from a failure to properly handle...
The vulnerability of Websoft HCM’s automation software for HR processes lies in the lack of a mechanism for generating error reports. This allows attackers to gain unauthorized access to protected information.
The vulnerability of Websoft HCM’s automation software for HR processes is related to deficiencies in the mechanism for generating error reports. Exploiting this vulnerability allows a malicious actor to inject incorrect values into parameters, thereby obtaining additional information in error...
The vulnerability of Websoft HCM’s automation software for HR processes lies in the lack of protection for operational data, allowing attackers to gain unauthorized access to protected information.
The vulnerability of Websoft HCM’s automation software for HR processes is related to the lack of protection for operational data. Exploiting this vulnerability allows an attacker to send incorrect values to parameters, receive error messages, or obtain debugging information regarding installatio...
Engine.IO 安全漏洞
Engine.IO is a transport-based implementation of Socket.IO's cross-browser/cross-device bi-directional communication layer.A denial-of-service vulnerability exists in versions of Socketio Engine.IO prior to 3.6.1, 4.0.0 and later, and prior to 6.2.1, which stems from a failure to properly handle...
Red Hat OpenShift 注入漏洞
Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat, Inc. that enables building, testing, deploying and running applications. Red Hat OpenShift has a security vulnerability that stems from a content spoofing flaw in OpenShift's OAuth endpoint, which can be...
Mozilla: Symlinks may resolve to partially uninitialized buffers
The Mozilla Foundation Security Advisory describes this flaw as: When resolving a symlink such as file:///proc/self/fd/1, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer...
Wireshark Denial of Service Vulnerability (CNVD-2023-62294)
Wireshark formerly known as Ethereal is a set of network packet analysis software from the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. Wireshark suffers from a denial of service vulnerability that stems from not properly...
Octopus Server 安全漏洞
Octopus Server is an automated deployment platform. Octopus Server has a security vulnerability that stems from its lengthy error message that may indicate the presence of a resource in a space that is inaccessible to the user...
Wireshark 缓冲区错误漏洞
Wireshark formerly known as Ethereal is a set of network packet analysis software from the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. Wireshark suffers from a denial of service vulnerability that stems from not properly...
GHSA-J5V3-363P-G843 OpenCRX vulnerable to password enumeration via error messages in password reset
OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a password reset which could enable an attacker to determine if a username, email or ID is valid...
OpenCRX vulnerable to password enumeration via error messages in password reset
OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a password reset which could enable an attacker to determine if a username, email or ID is valid...
CVE-2022-40084
OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a password reset which could enable an attacker to determine if a username, email or ID is valid...
Design/Logic Flaw
OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a password reset which could enable an attacker to determine if a username, email or ID is valid...
CVE-2022-40084
OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a password reset which could enable an attacker to determine if a username, email or ID is valid...
CVE-2022-40084
OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a password reset which could enable an attacker to determine if a username, email or ID is valid...