296 matches found
CVE-2022-31090 CURLOPT_HTTPAUTH option not cleared on change of origin in Guzzle
Guzzle, an extensible PHP HTTP client. Authorization headers on requests are sensitive information. In affected versions when using our Curl handler, it is possible to use the CURLOPTHTTPAUTH option to specify an Authorization header. On making a request which responds with a redirect to a URI wi...
SAP Releases June 2022 Security Updates
SAP has released security updates to address vulnerabilities affecting multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review SAP Security Patch Day – June 2022 and apply the necessary...
CVE-2022-27479
Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue...
CVE-2021-38296
Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would...
CVE-2022-24737 Exposure of Sensitive Information to an Unauthorized Actor in httpie
HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. Before 3.1.0, HTTPie didn‘t distinguish between cookies and host...
CVE-2022-24709 Cross site scripting in @awsui/components-react
@awsui/components-react is the main AWS UI package which contains React components, with TypeScript definitions designed for user interface development. Multiple components in versions before 3.0.367 have been found to not properly neutralize user input and may allow for javascript injection. Use...
CVE-2022-21657 X.509 Extended Key Usage and Trust Purposes bypass in Envoy
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set of certificates it accepts from the peer, either as a TLS client or a TLS server, to only those certificates that contain the necessary extendedKeyUsage...
AMI MegaRAC SP-X BMC Vulnerabilities - Lenovo Support US
No description provided...
Design/Logic Flaw
OpenOlat is a web-based e-learning platform for teaching, learning, assessment and communication, an LMS, a learning management system. In affected versions by manipulating the HTTP request an attacker can modify the path of a requested file download in the folder component to point to anywhere o...
Cisco Releases Security Updates for Multiple Products
Cisco has released security updates to address vulnerabilities in multiple Cisco products. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Cisco Security Advisories page and apply the necessary...
ROS-2-1642
2.1642 Vulnerability in SpamAssassin spam filtering tool CVE-2020-1946 1. Vulnerability description: CVE-2020-1946 A vulnerability in the SpamAssassin spam filtering tool, is related to improper input validation when processing rule configuration .cf files. Exploitation of the vulnerability could...
ROS-2-1721
2.1721 Multiple vulnerabilities in Mozilla Thunderbird CVE-2021-29957, CVE-2021-29956 1. Vulnerability Description: The vulnerability allows a remote attacker to bypass the security restrictions imposed.Identifier of the Information Security Threats Data Bank of the FSTEC of Russia :...
KLA12246 PE vulnerability in Microsoft Products (ESU)
An elevation of privilege vulnerability was found in Microsoft Products Extended Support Update. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2021-34481 Exploitation Public exploits exist for this vulnerability. Malware exists for this vulnerability...
Unbreakable Enterprise kernel-container security update
4.14.35-2047.504.2.el7 - md/raid1: properly indicate failure when ending a failed write request Paul Clements Orabug: 32887159 - video: hypervfb: Add ratelimit on error message Michael Kelley Orabug: 32856879 - Drivers: hv: vmbus: Initialize unloadevent statically Andrea Parri Microsoft Orabug:...
SYS.2.3.A17
Die Nutzung von Systemaufrufen SOLLTE insbesondere fuer exponierte Dienste und Anwendungen auf die unbedingt notwendige Anzahl beschraenkt werden z. B. durch seccomp. Die vorhandenen Standardprofile bzw. -regeln von SELinux, AppArmor sowie alternativen Erweiterungen SOLLTEN manuell ueberprueft un...
KLA12103 ACE vulnerabilities in Microsoft Exchange Server
Remote code execution vulnerabilities were found in Microsoft Exchange Server. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2021-26412 CVE-2021-26855 CVE-2021-27078 CVE-2021-27065 CVE-2021-26854 CVE-2021-26857 CVE-2021-26858 Exploitation This...
7 Essential Hosting Features You Can’t Compromise With
By Owais Sultan Hosting your website on the right platform is very crucial for your business. Here are some hosting features that are necessary for a website. This is a post from HackRead.com Read the original post: 7 Essential Hosting Features You Can’t Compromise With...
Oracle Releases January 2021 Security Bulletin
Oracle has released its Critical Patch Update for January 2021 to address 329 vulnerabilities across multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Oracle January 2021...
necessary-store.com Cross Site Scripting vulnerability OBB-1302560
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Apple Releases Security Updates for iCloud for Windows
Apple has released security updates to address vulnerabilities in iCloud for Windows 7.20 for Windows 7 and later and 11.3 for Windows 10 and later. An attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency...