nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS

This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters...

CVE-2021-25760

In JetBrains Hub before 2020.1.12669, information disclosure via the public API was possible...

JetBrains YouTrack 代码注入漏洞

YouTrack is a keyboard-based issue and project tracking tool from the Czech company JetBrains, primarily used for tracking tasks and defect correction arrangements during development. A server-side template injection vulnerability exists in JetBrains YouTrack versions prior to 2020.5.3123. An...

JetBrains Ktor framework 加密问题漏洞

JetBrains Ktor is a web application framework from the Czech company JetBrains. A default configuration issue vulnerability exists in versions of JetBrains Ktor prior to 1.4.2, which stems from the fact that the weak password suite is enabled by default. No details of the vulnerability are provid...

PT-2021-14393 · Unknown · Oauth2 Proxy

Name of the Vulnerable Software and Affected Versions: OAuth2 Proxy versions prior to 7.0.0 Description: The issue concerns the whitelist domain feature in OAuth2 Proxy, where a domain that ends similarly to the intended domain could be allowed as a redirect. For example, if a whitelist domain is...

UBUNTU-CVE-2021-3336

DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate. The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3...

CVE-2020-27299

The affected product is vulnerable to an out-of-bounds read, which may allow an attacker to obtain and disclose sensitive data information or cause the device to crash on the OPC UA Tunneller versions prior to 6.3.0.8233...

CVE-2021-2052

Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards component: E1 IOT Orchestrator Security. The supported version that is affected is Prior to 9.2.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise ...

AZL-27653 CVE-2020-24025 affecting package reaper for versions less than 3.1.1-9

Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path...

CVE-2020-26979

When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event and then redirect the user before navigation occurred to the desired, entered address. To construct a convincing spoof the attacker would have had to guess what...

Rust 缓冲区错误漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A buffer overflow vulnerability exists in Rust serdecbor crate versions prior to 0.10.2, which stems from the fact that the CBOR deserializer may cause stack consumption via nested semantic tags. No detailed...

Grupo Crk Banking Business Platform Cross-Site Scripting Vulnerability

Grupo Crk Banking Business Platform is a business management software from Grupo Crk, Portugal. A cross-site scripting vulnerability exists in CRK Business Platform version 2019.1 and prior versions, which stems from the application lacking proper validation of client-side data CRK, IDContratante...

B&r Automation APROL Authorization Issues Vulnerability

B&r Automation APROL is a Linux-based process control system for industrial control applications from Australian company B&r Automation. An authorization issue vulnerability exists in versions prior to B&R Industrial Automation APROL R4.2 V7.08, which can be exploited by an attacker to access...

CVE-2020-25839

NetIQ Identity Manager 4.8 prior to version 4.8 SP2 HF1 are affected by an injection vulnerability. This vulnerability is fixed in NetIQ IdM 4.8 SP2 HF1...

UBUNTU-CVE-2020-15680

If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken image size of a non-existent protocol handler. This allowed an attacker to successfully probe whether an external protocol handler was registered. This...

CVE-2020-14885

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromis...

CVE-2020-9112

Taurus-AN00B versions earlier than 10.1.0.156C00E155R7P2 have a privilege elevation vulnerability. Due to lack of privilege restrictions on some of the business functions of the device. An attacker could exploit this vulnerability to access the protecting information, resulting in the elevation o...

PrestaShop cross-site scripting vulnerability (CNVD-2020-59046)

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A security vulnerability exists in PrestaShop version 1.5.0.0, prior to 1.7.6.8, whic...

PrestaShop SQL Injection Vulnerability

PrestaShop is a set of open source e-commerce solutions from PrestaShop, USA. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A SQL injection vulnerability exists in PrestaShop version 1.7.5.0, versions prior to 1.7.6.8. The...

Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of CVE-2018-14371

A flaw was found in Eclipse Mojarra before version 2.3.14, where it is vulnerable to a path traversal flaw via the loc parameter or the con parameter. An attacker could exploit this flaw to read arbitrary files...