Design/Logic Flaw

Kentico Xperience 13.0.44 allows XSS via an XML document to the Media Libraries subsystem...

CVE-2021-22569

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated...

DEBIAN-CVE-2021-22569

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated...

AZL-41431 CVE-2021-22569 affecting package pytorch for versions less than 2.2.2-5

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated...

Code injection

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated...

SUSE-FU-2022:0039-1 Feature update for zxing-cpp libreoffice

This feature update for zxing-cpp and libreoffice fixes the following issues: Update LibreOffice from version 7.1.3.2 to 7.2.3.2 jscSLE-18213: - Fix external URL connections issues when WebDav is built using libserf. bsc1187173, bsc1186871 - Fix an issue with PPTX where one column becomes two...

CVE-2021-46163

Kentico Xperience 13.0.44 allows XSS via an XML document to the Media Libraries subsystem...

CVE-2021-46163

Kentico Xperience 13.0.44 allows XSS via an XML document to the Media Libraries subsystem...

CVE-2021-22569

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated...

com.busymachines:pureharm-json-circe_2.13.0-RC2 (=0.0.2-M13), io.circe:circe-jawn_2.13.0-RC2 (=0.12.0-M2) +5 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_2.13.0-RC2 (=0.14.2)

org.typelevel:jawn-parser2.13.0-RC2 MAVEN version =0.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser2.13.0-RC2 and may be impacted: - com.busymachines:pureharm-json-circe2.13.0-RC2 =0.0.2-M13 - io.circe:circe-jawn2.13.0-R...

com.github.xuwei-k:msgpack4z-jawn_2.13.0-M5 (=0.4.0), com.lihaoyi:ujson-circe_2.13.0-M5 (>=0.7.3 <=0.7.4) +25 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_2.13.0-M5 (>=0.14.0 <=0.14.1)

org.typelevel:jawn-parser2.13.0-M5 MAVEN version =0.14.0, =0.7.3, =2.1.0, =0.6.0, =0.11.0, =0.11.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.5.0-M2, =0.5.0-M2, =0.20.0, =0.20.0, =0.20.10 and more Source cves: CVE-2022-21653 Source advisory: OSV:GHSA-VC89-HCCF-RQ55...

ai.eto:rikai_2.12 (>=0.0.3 <=0.1.7), ai.mantik:bridge-protocol_2.12 (>=0.3.0 <=0.3.1-rc2) +1286 more potentially affected by CVE-2022-21653 via org.typelevel:jawn-parser_2.12 (>=0.14.0 <=1.3.1)

org.typelevel:jawn-parser2.12 MAVEN version =0.14.0, =0.0.3, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.1-rc2 and more Source cves: CVE-2022-21653 Source advisory: OSV:GHSA-VC89-HCCF-RQ55...

Client-Side JavaScript Prototype Pollution in oro/platform

Summary By sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are vulnerable to Prototype Pollution. Workarounds Configure WAF to dro...

Path Traversal

io.spinnaker.clouddriver:clouddriver-appengine is vulnerable to path traversal. The utility to extract files locally for deployment does not validate the paths, allowing a local attacker to override files on a particular container resulting in path traversal vulnerability. Man in the middle attac...

CVE-2021-43852

OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.1 <=4.6.0.0), ai.apiverse:apipulse (>='1.0.3' <=1.0.20) +6031 more potentially affected by CVE-2021-44832 via org.apache.logging.log4j:log4j-core (>=2.13.0 <=2.17.0)

org.apache.logging.log4j:log4j-core MAVEN version =2.13.0, =4.4.0.1, ='1.0.3', =0.0.2, =0.0.14, =2.1.0, =3.32.1.7, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.5.2 and more Source cves: CVE-2021-44832 Source advisory: OSV:GHSA-8489-44MV-GGJ8...

Huawei EulerOS: Security Advisory for libgcrypt (EulerOS-SA-2021-2922)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP9 : libgcrypt (EulerOS-SA-2021-2922)

According to the versions of the libgcrypt package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries...

EulerOS 2.0 SP9 : libgcrypt (EulerOS-SA-2021-2914)

According to the versions of the libgcrypt package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries...

vulhub

This repository is an offensive tool for vulnerability research and exploitation, specifically targeting various web applications and services. It contains a collection of exploits and tools for identifying and exploiting vulnerabilities in software and systems. The repository includes a variety ...