12042 matches found
OWASP ESAPI 路径遍历漏洞
OWASP ESAPI is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. A path traversal vulnerability exists in ESAPI versions prior to 2.3.0.0, which stems from the default implementation of...
Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2022-9313)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9313 advisory. - netfilter: nftables: initialize registers in nftdochain Pablo Neira Ayuso Orabug: 34012925 CVE-2022-1016 - btrfs: unlock newly allocated extent buffe...
April 25, 2022—KB5012637 (OS Build 20348.681) Preview
None None...
GHSA-XG75-Q3Q5-CQMV Denial of Service in http-swagger
Impact Allows an attacker to perform a DOS attack consisting of memory exhaustion on the host system. Patches Yes. Please upgrade to v1.2.6. Workarounds A workaround is to restrict the path prefix to the "GET" method. As shown below func main r := mux.NewRouter...
Struts ParameterInterceptor vulnerability allows remote command execution
Regular expression in ParametersInterceptor matches top'foo' as a valid expression, which OGNL treats as top'foo'0 and evaluates the value of 'foo' action parameter as an OGNL expression. This lets malicious users put arbitrary OGNL statements into any String variable exposed by an action and hav...
transfer or transferFrom without checking the boolean result
It was found some transfer, approve or transferFrom without checking the boolean result, ERC20 standard specify that the token can return false if this call was not made, so it's mandatory to check the result of approve methods. CoreCollection.solL175 ERC721Payable.solL54 --- The text was updated...
SUSE-SU-2022:1292-1 Security update for tomcat
This update for tomcat fixes the following issues: Security hardening, related to Spring Framework vulnerabilities: - Deprecate getResources and always return null bsc1198136...
Country Selector < 1.6.6 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the country and lang parameters before outputting them back in the response, leading to a Reflected Cross-Site Scripting " / " /...
Denial Of Service (DoS)
github.com/swaggo/http-swagger is vulnerable to denial of service. The vulnerability exists in the Handler function in swagger.godue to the non-standard http method which allows an attacker to cause the system crash...
Tobesoft Xplatform 输入验证错误漏洞
Tobesoft Xplatform is a set of Korean Tobesoft application development platform. The platform supports form and composite component inheritance, CSS auto-setting, and multi-document interfaces. An input validation error vulnerability exists in the execBrowser method of Tobesoft Xplatform prior to...
Fusion Builder < 3.6.2 - Unauthenticated SSRF
Description The plugin, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the server's local network...
http-swagger 安全漏洞
http-swagger is a net/http wrapper. A security vulnerability exists in http-swagge, which stems from versions of http-swagger prior to 1.2.6, where an attacker may be able to perform denial-of-service attacks, including running out of memory on the host system. The memory exhaustion is attributed...
PT-2022-16937 · Unknown · Http-Swagger
Name of the Vulnerable Software and Affected Versions: http-swagger versions prior to 1.2.6 Description: The issue allows an attacker to perform a denial of service attack consisting of memory exhaustion on the host system due to improper handling of HTTP methods. This can also lead to other...
GHSA-PFV6-PRQM-85Q8 Prototype Pollution in madlib-object-utils
The package madlib-object-utils before version 0.1.8 is vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix of CVE-2020-7701...
Prototype Pollution in madlib-object-utils
The package madlib-object-utils before version 0.1.8 is vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix of CVE-2020-7701...
UBUNTU-CVE-2022-24279
The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix of CVE-2020-7701...
Design/Logic Flaw
The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix of CVE-2020-7701...
CVE-2022-24279
The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix of CVE-2020-7701...
CVE-2022-24279
The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix of CVE-2020-7701...
