231585 matches found
CVE-2024-24828
CVE-2024-24828 describes a local privilege escalation in the Node.js tool pkg. The vulnerability arises because native-code packages built by pkg are written to a hardcoded, shared directory (/tmp/pkg/) on UNIX-like systems with non-unique, predictable names. An attacker with access to the same l...
Information disclosure
Sametime is impacted by sensitive information passed in URL...
CVE-2023-45718
CVE-2023-45718 affects HCL Sametime Web: a failure to invalidate sessions causes sensitive cookie values to persist after a user closes the session. The NVD entry notes a high overall impact (CVSS v3.1: 7.5, HIGH) with network attack vector and no user interaction. The description specifies cooki...
CVE-2023-45716
The CVE-2023-45716 entry involves IBM/HCL Sametime where sensitive information is transmitted in URLs, causing a potential information disclosure. Affected software is Sametime (HCL IBM Sametime family), with the underlying issue described as sensitive data leakage via URL parameters. Documented ...
CVE-2023-50349
CVE-2023-50349 affects HCL Sametime, specifically REST APIs in the Sametime Proxy, where a CSRF vulnerability can allow an attacker to perform malicious actions. The entry is supported by NVD data showing a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high impact ...
Input validation
Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient validation of administrator provided data. A rogue administrator could inject malicious code when importing images, leading to the execution of the malicious code on the...
CVE-2024-1245
CVE-2024-1245 – Concrete CMS stored XSS (pre-9.2.5) Affected product: Concrete CMS, version 9.x prior to 9.2.5. Vulnerability: Stored XSS in file attributes entered on the Edit Attributes page. Administrative input in file tags and description attributes is not sufficiently sanitized, enabling a ...
CVE-2024-1246
Concrete CMS 9.x prior to 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient input validation. A rogue administrator could inject malicious code during image import, potentially executing in users’ browsers. Public references (NVD, Red Hat, GHSA, OSV, Veraco...
Input validation
Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Role Name field which might be executed when users visit the...
CVE-2024-1247 Concrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name field
Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Role Name field which might be executed when users visit the...
Design/Logic Flaw
Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr. This issue affects Apache Solr: from 8.10.0 through 8.11.2, from 9.0.0 before 9.3.0. The Schema Designer was introduced to allow users to more easily configu...
Design/Logic Flaw
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. Solr Streaming Expressions allows users to extract data from other Solr Clouds, using a "zkHost" parameter. When original...
CVE-2023-50292
The CVE-2023-50292 issue affects Apache Solr before 9.3.0 and 8.11.x lines, where the Schema Designer could load external libraries from untrusted configSets due to missing trust handling. This could enable remote code execution when non-authenticated users configure Schema Sets. Affected version...
CVE-2023-50298
CVE-2023-50298: Apache Solr Streaming Expressions can reveal ZooKeeper credentials via zkHost if the SolrCloud uses ZooKeeper authentication. Affected: Solr 6.0.0–8.11.2 and 9.0.0–9.3.x (before 9.4.1). Root cause: zkHost usage may transmit ZooKeeper credentials/ACLs to an attacker-controlled serv...
CVE-2023-50386
CVE-2023-50386 is an Apache Solr vulnerability affecting 6.0.0–8.11.2 and 9.0.0–9.3.x that allows unrestricted uploading of Java jar/class files via the ConfigSets API. When backing up Solr Collections with LocalFileSystemRepository, backup files can land on directories in the Solr ClassLoader, p...
Null pointer dereference
Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference via the AP4StszAtom::GetSampleSize function...
Heap overflow
An issue in the HuginBase::ImageVariable::linkWith function of Hugin v2022.0.0 allows attackers to cause a heap-use-after-free via parsing a crafted image...
Heap overflow
An issue in the HuginBase::PanoramaMemento::loadPTScript function of Hugin v2022.0.0 allows attackers to cause a heap buffer overflow via parsing a crafted image...