5604 matches found
SUSE CVE-2024-11116
Inappropriate implementation in Blink in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...
net/http: Denial of service due to improper 100-continue handling in net/http
A flaw was found in Go. The net/http module mishandles specific server responses from HTTP/1.1 client requests. This issue may render a connection invalid and cause a denial of service...
The vulnerability of component E1 in the IOT Orchestrator Security application of JD Edwards EnterpriseOne allows a attacker to disclose protected information.
The vulnerability of component E1 in the JD Edwards EnterpriseOne Orchestrator Security application relates to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to disclose sensitive information using the HTTP protocol...
DEBIAN-CVE-2023-1932
A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or...
Security update for curl
This update for curl fixes the following issues: CVE-2024-9681: Fixed HSTS subdomain overwrites parent cache entry bsc1232528 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the comma...
Symfony 注入漏洞
Symfony is a PHP framework for web and console applications and a set of reusable PHP components from Symfony. Symfony suffers from an injection vulnerability that stems from allowing the separation of a PHP application from its global state...
Google Chrome 资源管理错误漏洞
Google Chrome is a web browser from Google, Inc USA. A security vulnerability exists in Google Chrome prior to version 30.0.6723.116, which originates from a heap corruption vulnerability that can be exploited by a remote attacker with the help of specially crafted hypertext markup language pages...
The vulnerability of the DevTools suite for web development in Microsoft Edge and Google Chrome browsers allows a hacker to execute arbitrary code.
The vulnerability of the DevTools suite for web development in Microsoft Edge and Google Chrome is related to insufficient testing of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created HTML page from a remote location...
CVE-2024-48352
Yealink Meeting Server before V26.0.0.67 is vulnerable to sensitive data exposure in the server response via sending HTTP request with enterprise ID...
The vulnerability in the web interface for managing microprogrammed software routers of Cisco Small Business RV042, RV042G, RV320, and RV325 allows a hacker to execute arbitrary code or cause service interruptions.
The vulnerability of the web interface for managing microprogrammed software routers of Cisco Small Business RV042, RV042G, RV320, and RV325 stems from the escape of operations beyond the buffer in memory, resulting from insufficient validation of input data during HTTP packet processing...
DEBIAN-CVE-2024-10488
Use after free in WebRTC in Google Chrome prior to 130.0.6723.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to type mixing errors. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information through a specially crafte...
The vulnerability of the User Interface component of the application for interacting with customers in Oracle Quoting, a system for automating business operations in the Oracle E-Business Suite. This vulnerability allows an attacker to gain unauthorized access to read, add, modify, or delete data.
The vulnerability of the User Interface component of the application for interacting with customers in Oracle Quoting, a system for automating business operations in the Oracle E-Business Suite, is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow ...
PT-2024-32620 · Sharp +1 · Sharp Mfps +1
Name of the Vulnerable Software and Affected Versions: Sharp and Toshiba Tec MFPs affected versions not specified Description: The issue is related to the improper processing of HTTP authentication requests by Sharp and Toshiba Tec MFPs, resulting in an authentication bypass. Recommendations: At...
Sharp MFP 安全漏洞
Sharp MFP is a series of multifunction printers from Sharp Japan. A security vulnerability exists in Sharp MFP that stems from not properly handling URL data in HTTP PUT requests, resulting in a path traversal vulnerability that could retrieve unexpected internal files when processing a carefully...
Huly Platform 安全漏洞
Huly Platform is an all-in-one project management platform from Huly open source. A security vulnerability exists in Huly Platform version v0.6.295. An attacker can exploit the vulnerability to execute arbitrary code by uploading a specially crafted HTML file to the tracker comment page...
PT-2024-31797 · Sharp +1 · Sharp Mfps +1
Name of the Vulnerable Software and Affected Versions: Sharp and Toshiba Tec MFPs affected versions not specified Description: The issue is related to the improper processing of query parameters in HTTP requests, resulting in an Out-of-bounds Read. Crafted HTTP requests may cause the affected...
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to type mixing errors. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information through a specially crafte...
The vulnerability of the User Interface component of the Oracle Installed Base system, a component of the Oracle E-Business Suite, allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the User Interface component of the Oracle Installed Base information storage center in the Oracle E-Business Suite related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to...
CVE-2024-30124
HCL Sametime is impacted by insecure services in-use on the UIM client by default. An unused legacy REST service was enabled by default using the HTTP protocol. An attacker could potentially use this service endpoint maliciously...