io.brooklyn.example:brooklyn-example-hello-world-hadoop-webapp (>=0.4.0, <=0.7.0-m1) potentially affected by CVE-2017-3161 via org.apache.hadoop:hadoop-client (1.0.2)

org.apache.hadoop:hadoop-client MAVEN version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hadoop:hadoop-client and may be impacted: - io.brooklyn.example:brooklyn-example-hello-world-hadoop-webapp =0.4.0, =0.7.0-m1 Source cves:...

DEBIAN-CVE-2022-30333

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract aka unpack operation, as demonstrated by creating a /.ssh/authorizedkeys file. NOTE: WinRAR and Android RAR are unaffected...

GHSA-G77G-VJJM-X83J Apache Tomcat Example Application CSRF and XSS Vulnerabilities

Cross-site request forgery CSRF vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attackers to add events as arbitrary users via the time and description parameters...

Apache Tomcat Example Application CSRF and XSS Vulnerabilities

Cross-site request forgery CSRF vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attackers to add events as arbitrary users via the time and description parameters...

GHSA-8G4F-FH7F-4FWH Apache Tomcat Default Installation Reveals Sensitive Information

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the 1 SnoopServlet or 2 TroubleShooter example servlets...

se.redmind:rmtest-appium (>=2.0.1, <=2.0.18), se.redmind:rmtest-cucumber-selenium (>=2.0.1, <=2.0.18) +5 more potentially affected by CVE-2022-28108 via org.seleniumhq.selenium:selenium-server (2.49.1)

org.seleniumhq.selenium:selenium-server MAVEN version 2.49.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.seleniumhq.selenium:selenium-server and may be impacted: - se.redmind:rmtest-appium =2.0.1, =2.0.1, =2.0.1, =2.0.1, =2.0.1, =2.0.7, =2.0.1,...

PT-2022-19687 · Gpac · Gpac

Name of the Vulnerable Software and Affected Versions: GPAC version 2.0.0 Description: The issue is related to a heap-based buffer over-read in the gp rtp builder do hevc function, located in the ietf/rtp pck mpeg4.c file. This problem is demonstrated by MP4Box. Recommendations: For GPAC version...

net.sourceforge.jfacets:jfacets-acegi (>=3.1, <=3.2.1), org.acegisecurity:acegi-security (1.0.3) +28 more potentially affected by CVE-2022-22968 via org.springframework:spring-context (1.2.8)

org.springframework:spring-context MAVEN version 1.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - net.sourceforge.jfacets:jfacets-acegi =3.1, =1.0.2, =1.0.2, =1.0.0, =1.0.2 -...

CVE-2022-24229

A cross-site scripting XSS vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers inject arbitrary HTML or JavaScript through /example/editor...

CVE-2022-24229

The CVE-2022-24229 entry describes an XSS vulnerability in ONLYOFFICE Document Server Example prior to version 7.0.0. The affected component/path is the example editor endpoint (/example/editor), allowing remote attackers to inject arbitrary HTML or JavaScript. The issue is tied to an external we...

CVE-2022-24229

A cross-site scripting XSS vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers inject arbitrary HTML or JavaScript through /example/editor...

CVE-2022-24229: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers inject arbitrary HTML or JavaScript through /example/editor...

Ascensio System ONLYOFFICE Document Server cross-site scripting vulnerability

Ascensio System ONLYOFFICE Document Server is an online office collaboration suite from Ascensio System, Latvia. The product supports viewing and editing of text, spreadsheets, presentations and more. A cross-site scripting vulnerability exists in ONLYOFFICE Document Server Example versions prior...

PT-2022-16548

Name of the Vulnerable Software and Affected Versions ONLYOFFICE Document Server Example versions prior to 7.0.0 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary HTML or JavaScript through the "/example/editor" API endpoint. This enables attackers to execut...

GHSA-XHR8-MPWQ-2RR2 Automatic named constructor discovery in Valinor

Design issue - automatic constructor discovery The issue arises when upgrading from cuyz/valinor:0.3.0 to a newer system on an existing application, which broke due to the wrong constructor being picked. Still, a bigger security concern is problematic, and it is akin to...

org.acegisecurity:acegi-security (1.0.4), org.acegisecurity:acegi-security-adapters (1.0.4) +33 more potentially affected by CVE-2022-22965 via org.springframework:spring-beans (2.0.4)

org.springframework:spring-beans MAVEN version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-beans and may be impacted: - org.acegisecurity:acegi-security 1.0.4 - org.acegisecurity:acegi-security-adapters 1.0.4 -...

org.camunda.bpm.extension.swagger.example:camunda-bpm-swagger-example-spring-boot (7.8.0), org.camunda.bpm.extension.swagger:swagger-ui (7.8.0) potentially affected by CVE-2018-25031 via org.webjars:swagger-ui (3.1.4)

org.webjars:swagger-ui MAVEN version 3.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:swagger-ui and may be impacted: - org.camunda.bpm.extension.swagger.example:camunda-bpm-swagger-example-spring-boot 7.8.0 -...

Plezi < 1.0.3 - Unauthenticated Stored XSS

The plugin has a REST endpoint allowing unauthenticated users to update the plzconfigurationtrackerenable option, which is then displayed in the admin panel without sanitisation and escaping, leading to a Stored Cross-Site Scripting issue curl -X POST...

Xerte 3.10.3 Directory Traversal

Exploit Title: Xerte 3.10.3 - Directory Traversal Authenticated Date: 05/03/2021 Exploit Author: Rik Lutz Vendor Homepage: https://xerte.org.uk Software Link: https://github.com/thexerteproject/xerteonlinetoolkits/archive/refs/heads/3.9.zip Version: up until 3.10.3 Tested on: Windows 10 XAMP CVE ...

Xerte 3.10.3 - Directory Traversal (Authenticated) Exploit

Exploit Title: Xerte 3.10.3 - Directory Traversal Authenticated Exploit Author: Rik Lutz Vendor Homepage: https://xerte.org.uk Software Link: https://github.com/thexerteproject/xerteonlinetoolkits/archive/refs/heads/3.9.zip Version: up until 3.10.3 Tested on: Windows 10 XAMP CVE : CVE-2021-44665...