CVE-2022-33690

Improper input validation in Contacts Storage prior to SMR Jul-2022 Release 1 allows attacker to access arbitrary file...

CVE-2022-2353

Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user...

Hyperledger Fabric vulnerable to Improper Input Validation in orderer/common/cluster consensus request

Impact If a consensus client sends a malformed consensus request to an orderer it may crash the orderer node. This fix checks for the malformed consensus request and returns an error to the consensus client. Specific Go Packages Affected github.com/hyperledger/fabric/orderer/common/cluster Patche...

CVE-2022-24806

net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can exploit an Improper Input Validation vulnerability when SETing malformed OIDs in master agent and subagent simultaneously. Version 5.9.2 contains a...

Improper Input Validation

jetty-http is vulnerable to improper input validation. The vulnerability exists because the authority function of HttpURI.java does not properly validate the path parameter as a valid authority, allowing an attacker to parse invalid URLs such as http://localhost;/path for the hostname...

The vulnerability of the modular interface between web servers and web applications in Rack, related to improper neutralization of special elements used in operating system commands, allows attackers to execute arbitrary shell commands on the target system.

The vulnerability of the modular interface between web servers and Rack web applications is related to improper input validation during data processing, as transmitted through the intermediate software Rack Lint and CommonLogger. Exploiting this vulnerability allows a remote attacker to send...

CVE-2022-31121 Improper Input Validation in fabric hyperledger

Hyperledger Fabric is a permissioned distributed ledger framework. In affected versions if a consensus client sends a malformed consensus request to an orderer it may crash the orderer node. A fix has been added in commit 0f1835949 which checks for missing consensus messages and returns an error ...

Improper Input Validation

In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This could allow for unmanaged rules to exist on the target system and leave the system in an unsafe state. A flaw was found in the Puppet...

Security Bulletin: IBM Engineering Test Management is vulnerable to execute arbitrary commands on system due to XStream ( CVE-2021-29505 ).

Summary IBM Engineering Test Management is vulnerable to remote attacker to execute arbitrary commands on the system, caused by improper input validation. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary commands on the system...

CVE-2022-27803

Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Space...

CVE-2022-28692

Improper input validation vulnerability in Scheduler of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Scheduler...

CVE-2022-29892

Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to repeatedly display errors in certain functions and cause a denial-of-service DoS...

CVE-2022-27803

Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Space...

CVE-2022-27807

Improper input validation vulnerability in Link of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to disable to add Categories...

CVE-2022-27803

CVE-2022-27803 is an improper input validation vulnerability in Cybozu Garoon Space, affecting Garoon 4.0.0 through 5.5.1. An authenticated remote attacker could alter Space data due to input validation weaknesses. Public sources (NVD, JVN, Red Hat, CNVD/CNNVD) corroborate the vulnerability and a...

PT-2022-19898 · Cybozu · Cybozu Garoon

Name of the Vulnerable Software and Affected Versions: Space of Cybozu Garoon versions 4.0.0 through 5.5.1 Description: The issue is related to improper input validation, allowing a remote authenticated attacker to cause a denial-of-service DoS by repeatedly displaying errors in certain functions...

Robustel R1510 web_server /action/remove/ API data removal vulnerability

Summary A data removal vulnerability exists in the webserver /action/remove/ API functionality of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary file deletion. An attacker can send a sequence of requests to trigger this vulnerability. Tested Versions Robustel R151...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to directory traversal due to its use of Apache Commons IO (CVE-2021-29425)

Summary Apache Commons IO is used by several components in IBM Cloud Pak for Multicloud Management Monitoring. The product does not allow input that processes files or directories, but the affected software has been updated out of an abundance of caution. Vulnerability Details CVEID: CVE-2021-294...

The vulnerability of the Yandex Browser lies in its lack of sufficient checks on input data, allowing a hacker to replace the values in the address bar.

The vulnerability of the Yandex Browser exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to substitute values in the URL string using the window.open function from a remote location...

SSRF via Improper Input Validation

Description Hostname is not detected because of improper handling of username and password. Based on real cases Proof of Concept shell ❯ node -e 'const parseUrl = require"parse-url"; console.logparseUrl"http://google:com:@@localhost"' protocols: 'http' , protocol: 'http', port: null, resource:...