5772 matches found
Design/Logic Flaw
XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulatin...
CVE-2021-43859 Denial of Service by injecting highly recursive collections or maps in XStream
XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulatin...
GHSA-77RM-9X9H-XJ3G vulnerabilities
Vulnerabilities for packages: druid...
GHSA-77RM-9X9H-XJ3G vulnerabilities
Vulnerabilities for packages: druid, spark-fips, mysql, spark, hadoop-client-modules...
@adobe/pdftools-extract-node-sdk (>=0.5.0-beta, <=0.6.0-beta), @adrian.insua/release-notes-generator (>=1.0.0, <=2.6.2) +136 more potentially affected by CVE-2022-21704 via log4js (>=6.0.0, <=6.3.0)
log4js NPM version =6.0.0, =0.5.0-beta, =1.0.0, =0.1.3, =0.0.1-beta.0, =0.0.1-beta.0, =4.0.2, =0.0.1, =1.0.4, =8.0.1, =0.0.46, =0.1.7 and more Source cves: CVE-2022-21704 Source advisory: OSV:GHSA-82V2-MX6X-WQ7Q...
GHSA-WRVW-HG22-4M67 vulnerabilities
Vulnerabilities for packages: druid, celeborn, hadoop-client-modules, trino...
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Ajax.NET Professional AjaxPro is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation...
CVE-2021-43853
Ajax.NET Professional AjaxPro is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation...
CVE-2021-43853 Cross-Site Scripting in AjaxNetProfessional
Ajax.NET Professional AjaxPro is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation...
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Ajax.Releases are affected. A workaround exists that replaces one of the core JavaScript files embedded in the library. See the GHSA-5q7q-qqw2-hjq7 for workaround details...
GHSA-5R5R-6HPJ-8GG9 Serialization gadget exploit in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl...
GHSA-V95C-P5HM-XQ8F
creationtimestamp| type| source ---|---|--- 2021-12-07 09:32:57+00:00| seen| https://t.me/BlueRedTeam/1289 2021-12-07 15:16:34+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/4922...
Using/Importing ERC1155Supply.sol from openzeppelin version 4.3.2
Handle hubble Vulnerability details Using/importing openZeppelin version 4.3.2 file ERC1155Supply.sol which has a security advisory. Reference : GHSA-wmpv-c2jp-j2xg Proof of Concept File : collateral/OverlayV1OVLCollateral.sol line 7: import...
GHSA-77VH-XPMG-72QH vulnerabilities
Vulnerabilities for packages: ctop...
Authentication Bypass by CSRF Weakness
Impact CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of solidusauthdevise are affected if protectfromforgery method is both: - Executed whether as: - A beforeaction callback the default - A prependbeforeaction option prepend: tr...
CVE-2021-41274
solidusauthdevise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidusauthdevise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of solidusauthdevi...
CVE-2021-41274
solidusauthdevise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidusauthdevise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of solidusauthdevi...
Cross site request forgery (csrf)
solidusauthdevise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidusauthdevise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of solidusauthdevi...
CVE-2021-41274 Authentication Bypass by CSRF Weakness
solidusauthdevise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidusauthdevise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of solidusauthdevi...
GHSA-V935-PQMR-G8V9 Unexpected panics in num-bigint
Impact Two scenarios were reported where BigInt and BigUint multiplication may unexpectedly panic. - The internal mac3 function did not expect the possibility of non-empty all-zero inputs, leading to an unwrap panic. - A buffer was allocated with less capacity than needed for an intermediate...