3226 matches found
Code injection
The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused...
CVE-2021-29040
The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused...
PT-2021-18039 · Liferay · Liferay Dxp +1
Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.3.4 and earlier Liferay DXP versions 7.0 through 7.0 before fix pack 97 Liferay DXP versions 7.1 through 7.1 before fix pack 20 Liferay DXP versions 7.2 through 7.2 before fix pack 10 Description: The JSON web servic...
CVE-2021-20393
IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196001...
CVE-2021-20393
IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196001...
CVE-2021-23135
Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions prior to 1.8.7; 1.7 versions prior to 1.7.14...
CVE-2021-23135
Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions prior to 1.8.7; 1.7 versions prior to 1.7.14...
CVE-2021-23135 Argo CD leaked secret data into error messages and logs on invalid edits via UI
Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions prior to 1.8.7; 1.7 versions prior to 1.7.14...
Argo 信息泄露漏洞
Argo is an open source container native workflow engine. A security vulnerability exists in Argo CD. The vulnerability stems from the exposure of system data in the program's Web UI to an unauthorized Control Sphere exploit, which could allow an attacker to leak confidential data leading to leaks...
CVE-2021-23135: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions prior to 1.8.7; 1.7 versions prior to 1.7.14...
PYSEC-2021-30
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters...
Design/Logic Flaw
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters...
CVE-2021-32561
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters...
PYSEC-2021-30
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters...
CVE-2021-32561
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters...
CVE-2021-32561
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters...
CVE-2021-32561: Improper Neutralization of Input During Web Page Generation
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters...
PT-2021-19783
Name of the Vulnerable Software and Affected Versions OctoPrint versions prior to 1.6.0 Description The issue allows for XSS because API error messages include the values of input parameters, such as username or other user-provided data. This can lead to malicious scripts being executed on the...
SUSE: Security Advisory (SUSE-SU-2021:0545-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2021-21421
node-etsy-client is a NodeJs Etsy ReST API Client. Applications that are using node-etsy-client and reporting client error to the end user will offer api key value too This is fixed in node-etsy-client v0.3.0 and later...