ClipperCMS 代码问题漏洞

ClipperCMS is a content management system CMS from the ClipperCMS team. A security vulnerability exists in ClipperCMS version 1.3.3, which stems from the inclusion of server-side request forgery SSRF via the pkgurl parameter in /manager/index.php...

SUSE-SU-2022:2568-1 Security update for SUSE Manager Server 4.2

This update fixes the following issues: apache-commons-csv: - Fix the URL for the package - Declare the LICENSE file as license and not doc apache-commons-math3: - Fix the URL for the package - Declare the LICENSE file as license and not doc drools: - Declare the LICENSE file as license and not d...

Code injection

All versions of package url-regex are vulnerable to Regular Expression Denial of Service ReDoS which can cause the CPU usage to crash...

CVE-2022-25839

The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is...

CVE-2022-25839 Improper Input Validation

The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is...

CVE-2022-25839

The CVE concerns the JavaScript package url-js prior to version 2.1.0 . The vulnerability arises from improper input validation during parsing in the URL.js parser, allowing hostname spoofing (for example, both http://\\\\localhost and http://localhost are treated as the same URL, with the backsl...

UPDATE: OWASP Dependency-Check 5.0.0

PenTestIT RSS Feed My first post about this open source OWASP project was about an older version. About 18 hours ago, a new version was released. This post discusses the changes made to the open source software composition analysis utility in the latest release yesterday. This is the OWASP...

Oracle Linux 6 : rsyslog (ELSA-2012-0796)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-0796 advisory. 5.8.10-2 - add patch to update information on debugging in the man page Resolves: 820311 - add patch to prevent debug output to stdout after forking Resolves:...

bug

Hello vuln, rpf bug. see in download function in search dir. int downloadchar url, char package, char ip //REQUIRES: wget existance; url && package && ip != NULL //EFFECTS : download the package via wget char page2048; int status, i; status = 0; memset page, 0x0, sizeofpage ; sprintfpage,...