14150 matches found
Denial Of Service (DoS)
etcd is vulnerable to denial of service DoS. It does not handle the case when an entry index is greater then the number of entries in the ReadAll method in wal/wal.go, leading to issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant and causing a runti...
CVE-2021-20289
A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The...
jqMix method dojox library Data Compromise
The vulnerability of the jqMix method implementation in the dojox library NPM package is related to incorrect elimination of special elements in the output data. Exploiting this vulnerability can allow an attacker to compromise the integrity of the data...
USN-4754-3 python2.7, python3.7, python3.8 vulnerabilities
USN-4754-1 fixed vulnerabilities in Python. This update provides the corresponding updates for Ubuntu 18.04 and Ubuntu 20.04. In the case of Python 2.7 for 20.04, these additional fixes are included: It was dicovered that Python allowed remote attackers to cause a denial of service resource...
Huawei EulerOS: Security Advisory for libX11 (EulerOS-SA-2021-1662)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2020-14989
An issue was discovered in Bloomreach Experience Manager brXM 4.1.0 through 14.2.2. It allows CSRF if the attacker uses GET where POST was intended...
Cross site request forgery (csrf)
An issue was discovered in Bloomreach Experience Manager brXM 4.1.0 through 14.2.2. It allows CSRF if the attacker uses GET where POST was intended...
Arbitrary Code Execution
tenable-jira-cloud is vulnerable to arbitrary code execution. An attacker with local access to the host is able to run arbitrary commands through the yaml.load method by running the application with a malicious YAML file...
AZL-79104 CVE-2021-27918 affecting package golang 1.26.7-1
encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader for xml.NewTokenDecoder returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method...
Design/Logic Flaw
encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader for xml.NewTokenDecoder returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method...
CVE-2021-27918
encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader for xml.NewTokenDecoder returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method...
NETGEAR JGS516PE/GS116Ev2 Buffer Overflow Vulnerability (CNVD-2021-17575)
The NETGEAR JGS516PE/GS116Ev2 is a 16-port Gigabit Smart Managed Plus switch. A buffer overflow vulnerability exists in the NSDP protocol authentication method in the NETGEAR JGS516PE/GS116Ev2 version 2.6.0.43. An attacker could exploit this vulnerability to cause the device to reboot...
GitHub Security Lab: [Java] CWE-598: Use of GET Request Method with Sensitive Query Strings
This bug was reported directly to GitHub Security Lab...
GHSA-8278-88VV-X98R Execution of untrusted code through config file
Impact It is possible to run arbitrary commands through the yaml.load method. This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file. Workarounds Manually adjust yaml.load to yaml.safeload For mo...
CVE-2020-35224
A buffer overflow vulnerability in the NSDP protocol authentication method on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allows remote unauthenticated attackers to force a device reboot...
EulerOS Virtualization 3.0.2.6 : libX11 (EulerOS-SA-2021-1441)
According to the versions of the libX11 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged attacker to...
EulerOS Virtualization 3.0.6.6 : ibus (EulerOS-SA-2021-1483)
According to the version of the ibus packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A flaw was discovered in ibus that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due t...
OpenCMS 11.0.2 Cross Site Request Forgery / Open Redirection
OpenCMS v11.0.2 -------------------------------------------------------------------------------------------------------------------------------------------------- CSRF - Login page vulnerable https://vulnerablehost.com/system/login - CSRF needs valid JSESSIONID to work, maybe logged Admin user...
Froala 3.2.6-1 Cross Site Scripting Vulnerability
Exploit Title: Stored XSS and Html Code Injection Editor Froala Version 3.2.6-1 Author: Vincent666 ibn Winnie Software Link: https://froala.com/wysiwyg-editor/ Tested on: Windows 10 Web Browser: Mozilla Firefox My Youtube Channel: https://www.youtube.com/channel/UCZOWpC2dW9sipPq5z63C2rQ PoC: In t...
OpenCMS 11.0.2 Cross Site Request Forgery / Open Redirection Vulnerability
OpenCMS v11.0.2 -------------------------------------------------------------------------------------------------------------------------------------------------- CSRF - Login page vulnerable https://vulnerablehost.com/system/login - CSRF needs valid JSESSIONID to work, maybe logged Admin user...