GHSA-8XXM-H73R-GHFJ Validation bypass in frourio

日本語 影響 v0.26.0以前のfrourioを使用している、かつvalidators/を利用している場合、ネストされたバリデータがリクエストのボディーとクエリに対して正しく働かないケースがあります。また、リクエストに対してバリデーションが効かなくなる入力があります。 パッチ frourioをv0.26.0かそれ以降のバージョンにアップデートをお願いします。frourio を使用したプロジェクトには class-transformer と reflect-metadata の依存への追加も必要となります。 ワークアラウンド...

CVE-2022-23623 Validation bypass in frourio

Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through validators/ folder are subject to a input validation vulnerability. Validators do not work properly for request bodies and queries in specific...

CVE-2022-23623

Frourio (TypeScript full-stack framework) versions prior to v0.26.0 using validators/ integration may fail input validation for request bodies and queries in certain cases, allowing some input to bypass validation. The root cause is improper validator behavior in the validators/ path. The advisor...

CVE-2022-23623 Validation bypass in frourio

Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through validators/ folder are subject to a input validation vulnerability. Validators do not work properly for request bodies and queries in specific...

CVE-2022-23624 Validation bypass in frourio-express

Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with class-validator through validators/ folder are subject to a input validation vulnerability. Validators do not work properly for request...

CVE-2022-23624 Validation bypass in frourio-express

Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with class-validator through validators/ folder are subject to a input validation vulnerability. Validators do not work properly for request...

CVE-2022-23624

Frourio-express contains an input validation vulnerability affecting users of versions prior to v0.26.0 when using the integration with class-validator via the validators/ folder. The issue leads to validators not working properly for request bodies and queries in specific situations, leaving som...

CVE-2021-25067

The Landing Page Builder WordPress plugin before 1.4.9.6 was affected by a reflected XSS in page-builder-add on the ulpbpost admin page...

NCH Reflect CRM Information Disclosure Vulnerability

An information disclosure vulnerability exists in NCH Reflect CRM, a customer relationship management software. The vulnerability stems from a failure to add valid access to configuration files and a failure to validate user permissions, which could be exploited by a local attacker to discover...

CVE-2021-37468

NCH Reflect CRM 3.01 allows local users to discover cleartext user account information by reading the configuration files...

CVE-2021-37468

NCH Reflect CRM 3.01 allows local users to discover cleartext user account information by reading the configuration files...

Design/Logic Flaw

NCH Reflect CRM 3.01 allows local users to discover cleartext user account information by reading the configuration files...

CVE-2021-37468

CVE-2021-37468 affects NCH Reflect CRM 3.01. The vulnerability enables local users to disclose plaintext user account information by reading configuration files, due to inadequate access control and insecure storage of credentials in configuration data. Impact is information disclosure with local...

CVE-2021-37468

NCH Reflect CRM 3.01 allows local users to discover cleartext user account information by reading the configuration files...

NCH Reflect CRM 信息泄露漏洞

An information disclosure vulnerability exists in NCH Reflect CRM, a customer relationship management software. The vulnerability stems from a failure to add valid access to configuration files and a failure to validate user permissions, which could be exploited by a local attacker to discover...

CVE-2021-32106

In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the GET'replace' variable. As a result, arbitrary Javascript code can get executed...

DEBIAN-CVE-2020-25715

A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting XSS attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity...

The vulnerability of the xbean-reflect/JNDI library component from Jackson-databind allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the xbean-reflect/JNDI library component related to Jackson-databind involves the restoration of unreliable data structures in memory. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

Krakow Internship

The beginning of a new year is a time to look back and reflect on the previous one. December 31st is also the end date of our annual Krakow Internship Program...

Exploit for Deserialization of Untrusted Data in Fasterxml Jackson-Databind

CVE-2020-8840：FasterXML/jackson-databind 远程代码执行漏洞 0x00 简介 jackson-databind 是隶属 FasterXML 项目组下的JSON处理库。 0x01 漏洞概述 2月19日，NVD发布安全通告披露了jackson-databind由JNDI注入导致的远程代码执行漏洞（CVE-2020-8840），CVSS评分为9.8...