15571 matches found
CVE-2023-49299 Apache DolphinScheduler: Arbitrary js execute as root for authenticated users
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue...
AZL-66918 CVE-2023-50572 affecting package jline 2.14.6-1
An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM OutofMemory error...
DEBIAN-CVE-2023-50572
An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM OutofMemory error...
UBUNTU-CVE-2023-50572
An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM OutofMemory error...
PT-2023-31595 · Unknown +1 · Jline-Groovy +1
Name of the Vulnerable Software and Affected Versions: jline-groovy version 3.24.1 Description: An issue in the component GroovyEngine.execute of jline-groovy allows attackers to cause an out of memory OOM error. Recommendations: For version 3.24.1, consider disabling the GroovyEngine.execute...
Cloudflare Wrangle Security Breach
Cloudflare Wrangler is a repository from Cloudflare, Inc. A security vulnerability exists in Cloudflare Wrangler versions prior to 3.19.0 that stems from the presence of an arbitrary code execution vulnerability that allows an attacker on a local network to connect to the inspector and run...
JLine Security Vulnerability
JLine is a Java library for processing console input from the JLine open source. A security vulnerability exists in JLine version v3.24.1, which stems from a security issue in the component GroovyEngine.execute that results in out of memory...
openSUSE 15 Security Update : zabbix (openSUSE-SU-2023:0419-1)
The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2023:0419-1 advisory. - An attacker who has the privilege to configure Zabbix items can use function icmpping with additional malicious command inside it to execute arbitrary...
CVE-2023-49469
Reflected Cross Site Scripting XSS vulnerability in Shaarli v0.12.2, allows remote attackers to execute arbitrary code via search tag function...
CVE-2023-43481
Affected software: Shenzhen TCL Browser TV Web BrowseHere (com.tcl.browser) v6.65.022_dab24cc6_231221_gp. Vulnerable component: com.tcl.browser.portal.browse.activity.BrowsePageActivity. Root cause/impact: remote attacker can execute arbitrary JavaScript code, enabling full control over the affec...
TCL BrowseHere Security Breach
Tcl Communication TCL BrowseHere is a video playback browser with a sophisticated interface from TCL Communication China. A security vulnerability exists in TCL BrowseHere version 6.65.022dab24cc6231221gp, which originates from a vulnerability that allows remote attackers to execute arbitrary...
Input validation
IBM Planning Analytics Local 2.0 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to upload a malicious script, which could allow the...
PT-2023-28692 · Dell · Dell Client Bios
Name of the Vulnerable Software and Affected Versions: Dell Client BIOS affected versions not specified Description: Dell Client BIOS contains a pre-boot direct memory access DMA vulnerability. An authenticated attacker with physical access to the system may potentially exploit this vulnerability...
The vulnerability of the `nvmet_tcp_execute_request()` function in the `drivers/nvme/target/tcp.c` file of the Linux NVMe kernel driver allows a attacker to cause a service failure.
The vulnerability of the nvmettcpexecuterequest function in the drivers/nvme/target/tcp.c file of the Linux NVMe kernel driver is related to the assignment of a null pointer. Exploiting this vulnerability could allow a remote attacker to cause a service failure...
Vulnerability fixed in IBM Informix
IBM has fixed a vulnerability in the JDBC driver of Informix. A malicious person with rights to use the API could can exploit the vulnerability to execute arbitrary code execute code with permissions from the application using the JDBC driver. Because it cannot be estimated with what permissions...
When the returnNative parameter is set to true in the _params provided to MoneyMarketHook.execute, it is not handled properly and could disrupt user expectations
Lines of code Vulnerability details Impact When param.returnNative is set to true while calling MoneyMarketHook.execute, users expect the returned token from the withdraw operation to be in native form and sent to the caller. However, in the current implementation, this is not considered and coul...
Lack of receive() inside MoneyMarketHook contract when interacting with WNATIVE.
Lines of code Vulnerability details Impact MoneyMarketHook is expected to work with the native balance when interacting with WNATIVE, especially when params.returnNative is set to true during the execute operation. However, due to the lack of a receive function inside the contract, MoneyMarketHoo...
Security Bulletin: IBM® Db2® is affected by multiple vulnerabilities in the consumed PCRE library.
Summary IBM® Db2® is affected by multiple vulnerabilities in the consumed PCRE library. Vulnerability Details CVEID:CVE-2015-8383 DESCRIPTION: PCRE is vulnerable to a heap-based buffer overflow, caused by the improper handling of certain repeated conditional groups. By using a specially crafted...
Malicious user can still native tokens of MoneyMarketHook caller
Lines of code Vulnerability details Proof of Concept MoneyMarketHook allows user to chain some actions into one multicall to the InitCore. In the end user can get all wrapped native tokens that he withdrew in a form of native token. Note, that this part of code withdraws all balance from wrapped...