7989 matches found
Octopus Server 授权问题漏洞
Octopus Server is an automated deployment platform. An authorization issue vulnerability exists in Octopus Server that stems from access rights being managed by an external authentication provider, where disabling or deleting a user's API key may still be valid after access rights have been...
Fodcha DDoS Botnet Resurfaces with New Capabilities
The threat actor behind the Fodcha distributed denial-of-service DDoS botnet has resurfaced with new capabilities, researchers reveal. This includes changes to its communication protocol and the ability to extort cryptocurrency payments in exchange for stopping the DDoS attack against a target,...
no interest calculation charging & lp provider reward in market contract
Lines of code Vulnerability details Impact there is no accrued interest charging for the borrower' debt, borrower at the same time cannot decrease their accured interestthis bug's detail is present in my previous finding, and there is also no reward for those lp provider who deposit their token i...
Remote Code Execution (RCE)
Apache Flume is vulnerable to remote code execution. The vulnerability exists due to improper validations of jms source and provider url where the attacker can use the jms source with an unsafe provider url causing arbitrary code executions...
CVE-2022-42468
Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol...
Metabase 授权问题漏洞
Metabase is an open source data analytics platform from the US-based Metabase Inc. A security vulnerability exists in Metabase that stems from the ability of single sign-on SSO users to reset their passwords on Metabase, which could allow users to access it without going through the SSO IdP...
Apache Flume 注入漏洞
Apache Flume is the United States Apache Apache Foundation of a distributed, reliable and available services. It is used to efficiently collect, aggregate and move large amounts of log data. An injection vulnerability exists in Apache Flume versions 1.4.0 through 1.10.1, which stems from...
CVE-2022-42468 Apache Flume prior to 1.11.0 has an Improper Input Validation (JNDI Injection) in JMSSource
Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol...
OESA-2022-2006 libexif security update
Most digital cameras produce EXIF files, which are JPEG files with extra tags that contain information about the image. The EXIF library allows you to parse an EXIF file and read the data from those tags. Security Fixes: In libexif, there is a possible out of bounds write due to an integer...
Ankr Becomes First RPC Provider to the Aptos Blockchain
By Waqas Ankr has added another accomplishment to its already diverse profile by becoming one of the first RPC providers… This is a post from HackRead.com Read the original post: Ankr Becomes First RPC Provider to the Aptos Blockchain...
CVE-2022-38697
In messaging service, there is a missing permission check. This could lead to access unexpected provider in contacts service with no additional execution privileges needed...
CVE-2022-38697
In messaging service, there is a missing permission check. This could lead to access unexpected provider in contacts service with no additional execution privileges needed...
PT-2022-24532 · Unisoc (Shanghai) Technologies Co. +1 · Sc9863A/Sc9832E/Sc7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 +1
Name of the Vulnerable Software and Affected Versions: messaging service affected versions not specified Description: The issue is related to a missing permission check in the messaging service. This could allow access to an unexpected provider in the contacts service without requiring any...
CVE-2022-38697
In messaging service, there is a missing permission check. This could lead to access unexpected provider in contacts service with no additional execution privileges needed...
CVE-2022-39299
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML elemen...
PT-2022-24883 · Unknown +1 · Passport-Saml +1
Name of the Vulnerable Software and Affected Versions: node-saml versions prior to 4.0.0-beta5 Description: A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML...
CVE-2022-20439
In Messaging, There has unauthorized provider, this could cause Local Deny of Service.Product: AndroidVersions: Android SoCAndroid ID: A-242266172...
CVE-2022-20439
In Messaging, There has unauthorized provider, this could cause Local Deny of Service.Product: AndroidVersions: Android SoCAndroid ID: A-242266172...
