4170 matches found
Adobe RoboHelp Server Path Traversal
The vulnerability of server-based corporate software for project monitoring and management in Adobe RoboHelp Server relates to the ability to load arbitrary files beyond the expected directory structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code in the...
UBUNTU-CVE-2022-22293
admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAINMAXDECIMALSTOT parameter...
Dolibarr cross-site scripting vulnerabilities
Dolibarr is an application. A modern software package that helps manage your organization's activities. a security vulnerability exists in Dolibarr, which stems from allowing HTML injection in admin limits.php in Dolibarr 7.0.2. No details of the vulnerability are currently available...
PT-2022-15338 · Dolibarr · Dolibarr
Name of the Vulnerable Software and Affected Versions: Dolibarr version 7.0.2 Description: The issue allows HTML injection, as demonstrated by the MAIN MAX DECIMALS TOT parameter in the "admin/limits.php" endpoint. Recommendations: For Dolibarr version 7.0.2, consider restricting access to the...
UBUNTU-CVE-2021-21708
In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTERVALIDATEFLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in...
Linux sound/usb/mixer.c Heap Buffer Overflow Info Disclosure
The vulnerability in the sound/usb/mixer.c component of the Linux kernel is related to the operation of pushing data beyond the buffer’s allowed limits. Exploiting this vulnerability can allow an attacker to access confidential information or cause service failures...
PT-2021-27149
Name of the Vulnerable Software and Affected Versions Linux Kernel versions 3.18 through 5.4.167 Description The issue is related to the xen/netback component, where it does not properly limit the number of packages that can be queued. This could potentially lead to security vulnerabilities,...
PT-2021-27179
Name of the Vulnerable Software and Affected Versions xen/netback versions prior to v5.10.88 Description The issue is related to the xen/netback component, where it does not properly limit the number of packages that can be queued. This could potentially lead to security vulnerabilities, although...
PT-2021-27127
Name of the Vulnerable Software and Affected Versions xen/netback versions 3.18 through 4.19.221 Description The issue is related to the xen/netback component, where it does not properly limit the number of packages that can be queued. This could potentially lead to security vulnerabilities,...
WISE-4060 Adam-6050 Adam.NET Utility Authentication Bypass
The vulnerability of the Microprogrammed Ethernet module WISE-4060, Adam-6050 D, and Adam.NET Utility is related to the absence of authentication attempt limits. Exploiting this vulnerability can allow a malicious actor to gain full access to the device remotely...
RUSTSEC-2021-0131 Integer overflow in the bundled Brotli C library
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. An updated version of brotli-sys has not...
RUSTSEC-2021-0132 Integer overflow in the bundled Brotli C library
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. If one cannot update the C library, its...
Integer overflow in the bundled Brotli C library
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. If one cannot update the C library, its...
Integer overflow in the bundled Brotli C library
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. An updated version of brotli-sys has not...
OPENSUSE-SU-2021:1602-1 Security update for nextcloud
This update for nextcloud fixes the following issues: Update to 20.0.14 Security issues fixed: CVE-2021-41179: Fix boo1192028 - CWE-304: Two-Factor Authentication not enforced for pages marked as public CVE-2021-41178: Fix boo1192030 - CWE-434: File Traversal affecting SVG files on Nextcloud Serv...
WordPress WP Limits plugin cross-site request forgery vulnerability
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. WP Limits plugin is a WordPress open source application plugin. WordPress WP Limits plugin in version 1.0 and...
USN-5202-1 openjdk-8, openjdk-lts vulnerabilities
Varnavas Papaioannou discovered that the FTP client implementation in OpenJDK accepted alternate server IP addresses when connecting with FTP passive mode. An attacker controlling an FTP server that an application connects to could possibly use this to expose sensitive information rudimentary por...
GNU Mailman Authentication Bypass
The vulnerability of the GNU Mailman email distribution management package lies in the insufficient limitation on the number of authentication attempts. Exploiting this vulnerability allows a malicious actor to bypass the authentication process by forcibly obtaining the administrator’s password...
jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck
jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...
jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck
jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...