5546 matches found
PT-2022-36887
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-double-free crash. Technical details include the crash type and state, specifically mentioning functions such as flb pack...
expat security update
2.2.5-4.0.1.3 - lib: Prevent integer overflow in doProlog CVE-2022-23990Orabug: 33910314...
Sql injection
Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained...
CVE-2021-45793
Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained...
CVE-2021-45793
CVE-2021-45793 (Slims9 Bulian 9.4.2) is due to a SQL injection in lib/comment.inc.php. The NVD/Nuclei entries describe an SQLi that can lead to retrieving user data from the database; the Circl/RedHat entries corroborate affected software. The referenced exploit path is via the comment field, ena...
PT-2022-12410
Name of the Vulnerable Software and Affected Versions Slims9 Bulian version 9.4.2 Description The issue affects the lib/comment.inc.php file, allowing SQL injection attacks that can result in the obtainment of user data. Recommendations For Slims9 Bulian version 9.4.2, consider restricting access...
CVE-2021-45793: Improper Neutralization of Special Elements used in an SQL Command
Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained...
redhat-support-lib-python and redhat-support-tool bug fix and enhancement update
An update is available for redhat-support-tool, redhat-support-lib-python. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The redhat-support-tool utility...
CVE-2021-46704
In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument lib/ui/api.ts and lib/ping.ts. The vulnerability arises from insufficient input validation combined with a missing authorization check...
PT-2022-12907
Name of the Vulnerable Software and Affected Versions GenieACS versions 1.2.x through 1.2.7 Description The issue arises from insufficient input validation combined with a missing authorization check in the UI interface API, allowing unauthenticated OS command injection via the ping host argument...
CVE-2021-46704: Improper Neutralization of Special Elements used in an OS Command
In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument lib/ui/api.ts and lib/ping.ts. The vulnerability arises from insufficient input validation combined with a missing authorization check...
CVE-2022-25069
Mark Text v0.16.3 was discovered to contain a DOM-based cross-site scripting XSS vulnerability which allows attackers to perform remote code execution RCE via injecting a crafted payload into /lib/contentState/pasteCtrl.js...
PT-2022-17067
Name of the Vulnerable Software and Affected Versions Mark Text version 0.16.3 Description A DOM-based cross-site scripting XSS issue allows attackers to perform remote code execution RCE by injecting a crafted payload into /lib/contentState/pasteCtrl.js. This enables attackers to execute malicio...
lib
Linuxfabrik Python Libraries Python 3.9+ modules for Linuxfa...
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that...
Sandbox bypass vulnerability in workflow-cps-global-lib
workflow-cps-global-lib 552.vd9cc05b8a2e1 and earlier uses the same workspace directory for all checkouts of Pipeline libraries with the same name regardless of the SCM being used and the source of the library configuration. This allows attackers with Item/Configure permission to execute arbitrar...
Sandbox bypass vulnerability in workflow-cps-global-lib
workflow-cps-global-lib 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any sanitization. This allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially crafted...
Sandbox bypass vulnerability in workflow-cps-global-lib
workflow-cps-global-lib 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create directories without canonicalization or sanitization. This allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially...
CVE-2022-23634
Puma is a Ruby/Rack web server built for parallelism. Prior to puma version 5.6.2, puma may not always call close on the response body. Rails, prior to version 7.0.2.2, depended on the response body being closed in order for its CurrentAttributes implementation to work correctly. The combination ...
