GHSA-8V3J-JFG3-V3FV Prototype Pollution in Sails.js

Sails.js = 1.5.2 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules. A patch is available in the master branch of Sails.js's GItHub repository...

CVE-2022-26081

The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer...

CVE-2021-44908

CVE-2021-44908 describes a prototype pollution flaw in Sails.js where the vulnerability exists in the function loadActionModules() inside controller/load-action-modules.js. The affected software is Sails.js versions up to and including 1.4.0. The underlying cause is prototype pollution, enabling ...

Sails.js 注入漏洞

Sails.js is a Node.js-based web application framework from Sails, Inc. Sails.js suffers from an injection vulnerability that originates in the loadActionModules function in controller/load-action-modules.js, which is susceptible to a prototype contamination vulnerability. The vulnerability affect...

Authentication flaw

Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authentication cookie replaced with an authentication cookie from another user, effectively giving them control of the other user's account and...

Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.

...

Samsung Bixby Touch安全漏洞

An access control error vulnerability exists in Samsung Bixby Touch, a virtual intelligent assistant for Samsung mobile devices, which stems from a failure to properly restrict access to resources from unauthorized roles in Bixby Touch. An attacker could exploit the vulnerability to allow untrust...

PT-2022-17550 · Samsung · Bixbytouch

Name of the Vulnerable Software and Affected Versions: BixbyTouch versions prior to 2.2.00.6 Description: The issue is related to improper access control, allowing untrusted applications to load arbitrary URL and local files in webview. Recommendations: For versions prior to 2.2.00.6, update to...

CVE-2021-3656

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB virtual machine control block provided by the L1 guest to spawn/handle a nested guest L2. Due to improper validation of the "virtext" field, this issue could allow a malicious...

CVE-2021-23191

A security issue was found in htmldoc v1.9.12 and before. A NULL pointer dereference in the function imageloadjpeg in image.cxx may result in denial of service...

AZL-8871 CVE-2022-25634 affecting package qt5-qtsvg for versions less than 5.12.11-3

Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory...

Access to XMLHTTPRequest at <URL> from origin <URL>has been blocked by CORS policy

When navigating to load balanced VIP, 'Cannot Complete Your Request' is seen .HAR file will showAccess to XMLHTTPRequest at from origin has been blocked by CORS policy...

Air Cargo Management System v1.0 - SQLi

Title: Air Cargo Management System v1.0 - SQLi Author: nu11secur1ty Date: 02.18.2022 Vendor: https://www.sourcecodester.com/users/tips23 Software: https://www.sourcecodester.com/php/15188/air-cargo-management-system-php-oop-free-source-code.html Reference:...

unbound: integer overflow in a size calculation in dnscrypt/dnscrypt.c

A flaw was found in unbound. An integer overflow in dnscloadlocaldata function may lead to a buffer overflow of the allocated buffer if the size can be controlled by an attacker. The highest threat from this vulnerability is to data confidentiality and integrity as well as service availability...

CVE-2016-20013

sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service CPU consumption because the algorithm's runtime is proportional to the square of the length of the password...

Cryptomator 代码问题漏洞

Cryptomator is a simple digital self-defense tool from the Cryptomator community. It is used to protect data. Cryptomator suffers from a code issue vulnerability that stems from the fact that an attacker can exploit the vulnerability can exploit this by creating a malicious .dylib file that can b...

Containous Traefik Trust Management Issue Vulnerability (CNVD-2022-13371)

Containous Traefik is a reverse proxy and load balancer from Containous, U.S. Containous Traefik is vulnerable to a trust management issue that stems from the fact that when a request is sent using an FQDN processed by a router configured with a dedicated TLS configuration, the TLS configuration...

Default configuration

Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.6.1, Traefik skips the router transport layer security TLS configuration when the host header is a fully qualified domain name FQDN. For a request, the TLS configuration choice can be different than the router choice, which...

CVE-2022-23632

CVE-2022-23632 affects Traefik (HTTP reverse proxy/load balancer). Prior to v2.6.1, when the host header is an FQDN, the router’s TLS configuration can be ignored and a different TLS setup may be applied, potentially using the default TLS configuration instead of the configured one. If CNAME flat...

CVE-2022-23632 Traefik skips the router TLS configuration when the host header is an FQDN

Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.6.1, Traefik skips the router transport layer security TLS configuration when the host header is a fully qualified domain name FQDN. For a request, the TLS configuration choice can be different than the router choice, which...