7236 matches found
aide: heap-based buffer overflow on outputs larger than B64_BUF
A heap-based buffer overflow vulnerability in the base64 functions of AIDE, an advanced intrusion detection system. An attacker could crash the program and possibly execute arbitrary code through large 16k extended file attributes or ACL...
VMware Spring Cloud Functions Installed
Binary data vmwarespringcloudfunctioninstalled.nbin...
Spring Cloud Function SpEL Injection (CVE-2022-22963) Exploited in the Wild
Although Spring Cloud Functions are not as widespread as the Log4j library, and should provide a good separation from the hosting server, some draw the line between the two, due to the ease of exploitation over HTTP/s. This new vulnerability will definitely result in many threat actors launching...
Pear Admin Think Cross-Site Scripting Vulnerability
Pear Admin Think is a rapid development platform based on thinkphp6 that allows you to quickly build your functional business with simple code generation functionality. pear Admin Think 5.0.6 and prior versions contain a cross-site scripting vulnerability that stems from the program's lack of dat...
CVE-2022-24135
QingScan 1.3.0 is affected by Cross Site Scripting XSS vulnerability in all search functions...
CVE-2022-24135
QingScan 1.3.0 is affected by Cross Site Scripting XSS vulnerability in all search functions...
Cross site scripting
QingScan 1.3.0 is affected by Cross Site Scripting XSS vulnerability in all search functions...
CVE-2022-24135
QingScan 1.3.0 is affected by Cross Site Scripting XSS vulnerability in all search functions...
CVE-2022-24135
QingScan 1.3.0 is affected by Cross Site Scripting XSS vulnerability in all search functions...
CVE-2021-41594
In RSA Archer 6.9.SP1 P3, if some application functions are precluded by the Administrator, this can be bypassed by intercepting the API request at the /api/V2/internal/TaskPermissions/CheckTaskAccess endpoint. If the parameters of this request are replaced with empty fields, the attacker achieve...
Add a timelock to DiamondCutFacet
Lines of code Vulnerability details Impact To give more trust to users: functions that set key/critical variables should be put behind a timelock. Proof of Concept Tools Used Remix Recommended Mitigation Steps Add a timelock to setter functions of key/critical variables. --- The text was updated...
Cross site scripting
A Cross Site Scripting XSS vulnerability exists in pearadmin pear-admin-think =5.0.6, which allows a login account to access arbitrary functions and cause stored XSS through a fake User-Agent...
Philips e-Alert 访问控制错误漏洞
Philips Philips e-Alert is a proactive, sensor-based approach to monitoring imaging systems from Philips in the Netherlands. Provides rapid insight into critical MRI parameters, helping biomedical and Philips service engineers take quick action to resolve issues before they escalate. An access...
CVE-2021-46433
In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCodeto bypass sandbox to execute arbitrary PHP code when disablenativefuncs is true...
fenom 安全漏洞
fenom is a lightweight and fast PHP template engine. fenom 2.12.1 and earlier versions are vulnerable to code injection, which stems from a failure to properly filter the construct command special characters, commands, etc. in the getTemplateCode function of fenom/src/Fenom/Template.php, which ca...
The vulnerability of the PTC Axeda platform for creating and deploying corporate-level applications lies in the lack of authentication for critical functions, which allows a malicious actor to disable certain services.
The vulnerability of the PTC Axeda platform for creating and deploying corporate-level applications is related to the lack of authentication for critical functions. Exploiting this vulnerability could allow a malicious actor to disable certain services by sending specially crafted commands remote...
The vulnerability of the CLI command-line interface of the ConfD Common Execution Environment (CEE) deployment and management environment for cloud network functions based on Cisco Ultra Cloud Core – Subscriber Microservices Infrastructure (SMI) allows a malicious actor to execute arbitrary commands and gain elevated privileges.
The vulnerability of the CLI command-line interface of the ConfD Common Execution Environment CEE for deploying and managing cloud network functions based on Cisco Ultra Cloud Core – Subscriber Microservices Infrastructure SMI is related to deficiencies in access control. Exploiting this...
[SECURITY] Fedora 36 Update: proj-8.2.1-6.fc36
Proj and invproj perform respective forward and inverse transformation of cartographic data to or from cartesian data with a wide range of selectable projection functions...
[SECURITY] Fedora 36 Update: geos-3.10.2-4.fc36
GEOS Geometry Engine - Open Source is a C++ port of the Java Topology Suite JTS. As such, it aims to contain the complete functionality of JTS in C++. This includes all the OpenGIS "Simple Features for SQL" spatial predicate functions and spatial operators, as well as specific JTS topology...