2262 matches found
MediaWiki makeCollapsible allows applying event handler to any CSS selector
In MediaWiki before 1.34.1, users can add various Cascading Style Sheets CSS classes which can affect what content is shown or hidden in the user interface to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler ...
GHSA-VPM6-H53M-X2XF Drupal improper access restrictions
Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page...
Drupal Users without "Administer comments" can set comment visibility on nodes they can edit
Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes...
CVE-2022-28937
CVE-2022-28937 affects FISCO-BCOS release-3.0.0-rc2. A malicious node can send an invalid proposal with an invalid header, causing normal nodes to stop producing new blocks and to stop processing new client requests. The issue impacts block production and request handling (availability) with a CV...
GHSA-9PVX-FWWH-W289 Puppet does not properly restrict access to node resources
Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors...
Puppet does not properly restrict access to node resources
Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors...
Puppet does not properly restrict access to node resources
Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors...
Incorrect Authorization in Jenkins Mercurial Plugin
An improper authorization vulnerability exists in Jenkins Mercurial Plugin version 2.2 and earlier in MercurialStatus.java that allows an attacker with network access to obtain a list of nodes and users...
GHSA-F9CX-789C-W2MR Incorrect Authorization in Jenkins Mercurial Plugin
An improper authorization vulnerability exists in Jenkins Mercurial Plugin version 2.2 and earlier in MercurialStatus.java that allows an attacker with network access to obtain a list of nodes and users...
GHSA-W9GQ-8Q35-3JCC Jenkins Subversion Plugin Incorrect Authorization vulnerability
An improper authorization vulnerability exists in Jenkins Subversion Plugin version 2.10.2 and earlier in SubversionStatus.java and SubversionRepositoryStatus.java that allows an attacker with network access to obtain a list of nodes and users. As of version 2.10.3, the class handling requests to...
Incorrect Authorization in Jenkins Git Plugin
An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to obtain a list of nodes and users...
GHSA-46P2-FWQG-3H6M Incorrect Authorization in Jenkins Git Plugin
An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to obtain a list of nodes and users...
GHSA-2CM5-F78C-H2C8 Missing permission checks in Jenkins Distributed Fork Plugin
It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provides the dist-fork CLI command beyond the basic check for Overall/Read permission, allowing anyone with that permission to run arbitrary shell commands on all...
GHSA-9R7F-RQHW-J8H8 Incorrect permission checks in Pipeline: Nodes and Processes plugin
On Jenkins instances with Authorize Project plugin, the authentication associated with a build may lack the Computer/Build permission on some agents. This did not prevent the execution of Pipeline node blocks on those agents due to incorrect permissions checks in Pipeline: Nodes and Processes...
Intel In-Band Manageability 授权问题漏洞
Intel In-Band Manageability is a software from Intel Corporation USA. Helps manage individual devices and uses extensions to allow control of multiple nodes through Intel Architecture hosts. Intel In-Band Manageability prior to version 2.13.0 has an authorization issue vulnerability that stems fr...
USB-based Wormable Malware Targets Windows Installer
Credit: Red Canary Wormable malware dubbed Raspberry Robin has been active since last September and is wriggling its way through USB drives onto Windows machines to use Microsoft Standard Installer and other legitimate processes to install malicious files, researchers have found. Researchers at...
Researchers Warn of 'Raspberry Robin' Malware Spreading via External Drives
Cybersecurity researchers have discovered a new Windows malware with worm-like capabilities and is propagated by means of removable USB devices. Attributing the malware to a cluster named "Raspberry Robin," Red Canary researchers noted that the worm "leverages Windows Installer to reach out to...
Security Bulletin: IBM Cloud Kubernetes Service is affected by a containerd security vulnerability (CVE-2022-24769)
Summary IBM Cloud Kubernetes Service is affected by a security vulnerability found in containerd where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to...
A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network.
...
Vulnerability of the Cluster component: The general system for managing MySQL Cluster databases, which allows attackers to gain unauthorized access to protected information or cause service failures.
Vulnerability of the Cluster component: General database management systems like MySQL Cluster involve reading data from beyond the buffer in memory during data node processing. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information or cause service...