549 matches found
SUSE CVE-2012-0392
The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method...
SUSE CVE-2012-0393
The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object...
SUSE CVE-2014-0116
CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted request. NOTE: this vulnerability exists...
SUSE CVE-2022-27416
Tcpreplay v4.4.1 was discovered to contain a double-free via interceptorfree...
SUSE CVE-2022-29885
The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide...
SUSE CVE-2022-32091
MariaDB v10.7 was discovered to contain an use-after-poison in in interceptormemset at /libsanitizer/sanitizercommon/sanitizercommoninterceptors.inc...
CVE-2023-22798
Prior to commit 51867e0d15a6d7f80d5b714fd0e9976b9c160bb0, https://github.com/brave/adblock-lists removed redirect interceptors on some websites like Facebook in which the redirect interceptor may have been there for security purposes. This could potentially cause open redirects on these websites...
WP-Ban < 1.69.1 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Go to the plugin settings and set these fields...
WP-Ban < 1.69.1 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Go to the plugin settings and set these...
The vulnerability of the CookieInterceptor class implementation in the Apache Struts software platform allows a hacker to execute arbitrary code.
The vulnerability of the CookieInterceptor class implementation in the Apache Struts software platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to execute arbitrary code using a specially created HTTP cookie header...
The vulnerability of the ParametersInterceptor class implementation in the Apache Struts software platform allows attackers to compromise the integrity of the protected information.
The vulnerability of the ParametersInterceptor class implementation in the Apache Struts software platform is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to manipulate the integrity of protected information by using a class parameter passed t...
The vulnerability in the implementation of the OGNL expression transformation class for XWork command structures on the Apache Struts software platform allows attackers to circumvent security restrictions and execute arbitrary commands.
The vulnerability of the OGNL expression transformation class implementation in the XWork expression structure of the Apache Struts software framework is related to deficiencies in access control when using the ParametersInterceptor class with the parameter. Exploiting this vulnerability allows a...
AZL-43834 CVE-2022-35020 affecting package advancecomp 2.5-1
Advancecomp v2.3 was discovered to contain a heap buffer overflow via the component interceptormemcpy at /sanitizercommon/sanitizercommoninterceptors.inc...
CVE-2022-35020
Advancecomp v2.3 was discovered to contain a heap buffer overflow via the component interceptormemcpy at /sanitizercommon/sanitizercommoninterceptors.inc...
DEBIAN-CVE-2022-35020
Advancecomp v2.3 was discovered to contain a heap buffer overflow via the component interceptormemcpy at /sanitizercommon/sanitizercommoninterceptors.inc...
AZL-44895 CVE-2022-35020 affecting package advancecomp 2.6-1
Advancecomp v2.3 was discovered to contain a heap buffer overflow via the component interceptormemcpy at /sanitizercommon/sanitizercommoninterceptors.inc...
Heap overflow
Advancecomp v2.3 was discovered to contain a heap buffer overflow via the component interceptormemcpy at /sanitizercommon/sanitizercommoninterceptors.inc...
UBUNTU-CVE-2022-35020
Advancecomp v2.3 was discovered to contain a heap buffer overflow via the component interceptormemcpy at /sanitizercommon/sanitizercommoninterceptors.inc...
AdvanceCOMP 缓冲区错误漏洞
AdvanceCOMP is a cross-platform command line tool for data compression. The product is capable of optimizing compressed files and reducing their size. A security vulnerability exists in AdvanceCOMP v2.3, which stems from the component interceptormemcpy in...