152 matches found
CVE-2023-33246
CVE-2023-33246 props.setProperty 수정, 명령 실행...
jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified
A flaw was found in jackson-databind. This vulnerability occurs in the data-binding functionality where properties intended to be ignored are incorrectly restored and become writable again. An attacker could potentially exploit this by providing input that modifies data through these supposedly...
CVE-2026-59284
There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Spring Cloud Commons 4.0.0 - 4.2.6 Spring Cloud Commons 3.1.10 and earlier...
CVE-2026-47849 Spring Data REST allows mutation of identifier and version properties via JSON Patch
Spring Data REST does not guard identifier @Id and version @Version properties against mutation via RFC 6902 JSON Patch application/json-patch+json requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7....
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the env actuator endpoint when no allow list is enforced for property keys. An attacker can modify arbitrary environment properties by sending crafted requests to the writable endpoint. Note: This is only...
Improperly Controlled Modification of Dynamically-Determined Object Attributes
Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via reflective property binding in PropertyUtils.createObjectFromProperties. An attacker can modify security-sensitive object properties by supplying crafted...
The vulnerability of the doCertificateUpdate() function in the LXD container management system allows a attacker to escalate their privileges.
The vulnerability of the doCertificateUpdate function in the LXD container management system is related to insufficient control over the modification of dynamically defined object properties. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...
CVE-2025-20628: Insufficient Granularity of Access Control
An insufficient granularity of access control vulnerability exists in PingIDM formerly ForgeRock Identity Management where administrators cannot properly configure access rules for Remote Connector Servers RCS running in client mode. This means attackers can spoof a client-mode RCS if one exists ...
K000160223: Spring cloud gateway vulnerability CVE-2025-41243
Security Advisory Description Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: The application is using Spring Cloud Gateway Server Webflux Spring Cloud Gateway Server...
EUVD-2025-208180
Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's...
Important: Red Hat Security Advisory: firefox security update
An update for firefox is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
EUVD-2019-6363
Malware in sbrugna...
EUVD-2019-6358
Malware in sbrugna...
EUVD-2019-6374
Malware in sbrugna...
EUVD-2019-6383
Malware in sbrugna...
EUVD-2019-6360
Malware in sbrugna...
EUVD-2019-6433
Malware in sbrugna...
EUVD-2019-6384
Malware in sbrugna...