9448 matches found
Oracle WebLogic Server, Injection
Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services...
CVE-2021-44528
A open redirect vulnerability exists in Action Pack = 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website...
CVE-2021-44528
A open redirect vulnerability exists in Action Pack = 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website...
Authentication flaw
In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on framework droplet, but some API directly use the interface of framework gin thus bypassing th...
CVE-2021-45232 security vulnerability on unauthorized access.
In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on framework droplet, but some API directly use the interface of framework gin thus bypassing th...
Possible Open Redirect in Host Authorization Middleware
There is a possible open redirect vulnerability in the Host Authorization middleware in Action Pack. Specially crafted "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website...
GHSA-V39H-QM32-8GWQ Improperly Controlled Modification of Dynamically-Determined Object Attributes in express-mock-middleware
express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution. Exported functions by the package can be tricked into adding or modifying properties of the Object.prototype. Exploitation of this vulnerability requires creation of a new directory where an attack code can be placed whic...
CVE-2021-41246
Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including 2.5.1 do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation...
CVE-2021-41246
Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including 2.5.1 do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation...
CVE-2021-41246
Express OpenID Connect middleware for Express.js is affected. Versions up to and including 2.5.1 do not regenerate the session id and session cookie on login, enabling session-fixation risks. A patch exists in version 2.5.2, which fixes the issue. Several sources corroborate this behavior and pat...
IBM MQ Information Disclosure Vulnerability (CNVD-2021-92960)
IBM MQ IBM WebSphere MQ is a messaging middleware product from IBM of the United States. The product provides a reliable and proven messaging backbone primarily for service-oriented architectures SOA.IBM MQ has a security vulnerability that could be exploited by an attacker to obtain sensitive...
The vulnerability of the Oracle Reports Developer component of the Oracle Fusion Middleware software platform allows attackers to influence the integrity and confidentiality of the protected information.
The vulnerability of the Oracle Reports Developer component of the Oracle Fusion Middleware software is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to influence the integrity and confidentiality of protected information through the use of the...
IBM MQ Appliance has an unspecified vulnerability (CNVD-2021-92963)
The IBM MQ Appliance is an all-in-one appliance for rapid deployment of enterprise-class messaging middleware from IBM U.S.A. A security vulnerability exists in the IBM MQ Appliance that stems from the appliance being affected by a denial-of-service attack caused by a concurrency issue. No detail...
IBM MQ Denial of Service Vulnerability (CNVD-2021-93631)
IBM MQ formerly IBM WebSphere MQ is a robust, secure and reliable messaging middleware. a denial of service vulnerability exists in IBM MQ versions 8.0, 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.1 CD, 9.2 CD. The vulnerability stems from incorrectly processed messages. An attacker could exploit the...
CVE-2021-33493
The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format...
CVE-2021-33493
The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format...
CVE-2021-33493
The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format...
Code injection
The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format...
CVE-2021-33493
CVE-2021-33493 pertains to Open-Xchange OX App Suite (OX App Suite/OX Documents) up to version 7.10.5, where the middleware component allows Code Injection via YAML-formatted Java classes. The root cause is the handling of YAML-based Java class definitions in the middleware, enabling an attacker ...