CVE-2022-46836: Improper Input Validation

PHP code injection in watolib auth.php and hosttags.php in Tribe29's Checkmk = 2.1.0p10, Checkmk = 2.0.0p27, and Checkmk = 1.6.0p29 allows an attacker to inject and execute PHP code which will be executed upon request of the vulnerable component...

Server side request forgery (ssrf)

An SSRF issue was discovered in Reprise License Manager RLM web interface through 14.2BL4 that allows remote attackers to trigger outbound requests to intranet servers, conduct port scans via the actserver parameter in License Activation function...

CVE-2021-37498: Server-Side Request Forgery (SSRF)

An SSRF issue was discovered in Reprise License Manager RLM web interface through 14.2BL4 that allows remote attackers to trigger outbound requests to intranet servers, conduct port scans via the actserver parameter in License Activation function...

CVE-2022-3034: Improper Restriction of Rendered UI Layers or Frames

When receiving an HTML email that specified to load an iframe element from a remote location, a request to the remote document was sent. However, Thunderbird didn't display the document. This vulnerability affects Thunderbird 102.2.1 and Thunderbird 91.13.1...

CVE-2022-3034

When receiving an HTML email that specified to load an iframe element from a remote location, a request to the remote document was sent. However, Thunderbird didn't display the document. This vulnerability affects Thunderbird 102.2.1 and Thunderbird 91.13.1...

CVE-2022-45414

If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block...

Microsoft Exchange Server SSRF

The vulnerability of Microsoft Exchange Server is related to errors in processing input data in the OWA interface. Exploiting this vulnerability can allow a malicious actor to execute an SSRF attack remotely...

Mozilla: An iframe element in an HTML email could trigger a network request

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of sending a request to the remote document when receiving an HTML email that specified to load an iframe element from a remote location. However, Thunderbird didn't display the document...

Mozilla: An iframe element in an HTML email could trigger a network request

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of sending a request to the remote document when receiving an HTML email that specified to load an iframe element from a remote location. However, Thunderbird didn't display the document...

PT-2022-4601

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 102.2.1 Thunderbird versions prior to 91.13.1 Description The issue arises when Thunderbird receives an HTML email that specifies loading an iframe element from a remote location, resulting in a request being sent...

CVE-2022-32140: Buffer Copy without Checking Size of Input

Multiple CODESYS products are affected to a buffer overflow.A low privileged remote attacker may craft a request, which can cause a buffer copy without checking the size of the service, resulting in a denial-of-service condition. User Interaction is not required...

CVE-2022-32136: Access of Uninitialized Pointer

In multiple CODESYS products, a low privileged remote attacker may craft a request that cause a read access to an uninitialized pointer, resulting in a denial-of-service. User interaction is not required...

PT-2022-21111

Name of the Vulnerable Software and Affected Versions CODESYS products affected versions not specified Description A remote attacker may craft a request that causes an unexpected sign extension, potentially resulting in a denial-of-service condition or memory overwrite. Recommendations At the...

org.jenkins-ci.main:jenkins-test-harness (1.554.2), org.jenkins-ci.main:jenkins-war (1.554.2) +6 more potentially affected by CVE-2021-21604 via org.jenkins-ci.main:jenkins-core (1.554.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.554.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.554.2 - org.jenkins-ci.main:jenkins-war 1.554.2 -...

com.viltgroup.xcp.jenkins:xcp-ci (>=0.4.0, <=0.5.5), org.jenkins-ci.main:jenkins-test-harness (1.617) +2 more potentially affected by CVE-2019-10354 via org.jenkins-ci.main:jenkins-core (1.617)

org.jenkins-ci.main:jenkins-core MAVEN version 1.617 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.viltgroup.xcp.jenkins:xcp-ci =0.4.0, =0.5.5 - org.jenkins-ci.main:jenkins-test-harness 1.61...

CVE-2022-30954: Missing Authorization

Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server...

org.jenkins-ci.main:jenkins-war (1.532.2.jenkins-22395-diag) potentially affected by CVE-2018-1000407 via org.jenkins-ci.main:jenkins-core (1.532.2.jenkins-22395-diag)

org.jenkins-ci.main:jenkins-core MAVEN version 1.532.2.jenkins-22395-diag is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-war 1.532.2.jenkins-22395-diag Source cves:...

org.jenkins-ci.main:jenkins-test-harness (1.491), org.jenkins-ci.main:jenkins-war (1.491) +6 more potentially affected by CVE-2017-1000392 via org.jenkins-ci.main:jenkins-core (1.491)

org.jenkins-ci.main:jenkins-core MAVEN version 1.491 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.491 - org.jenkins-ci.main:jenkins-war 1.491 -...

CVE-2022-24125: Undefined Security Weakness

The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send arbitrary push requests to clients via a RequestSendMessageToPlayers request. For example, ability to send a push message to hundreds of thousands of machines is only restricted o...

Spring Cloud Gateway Remote Code Execution Vulnerability

Spring Cloud GateWay is a library provided for building API gateways on top of Spring WebFlux.A remote code execution vulnerability exists in Spring Cloud Gateway, which occurs in the Actuator endpoint of the Spring Cloud Gateway application, which is enabled, public and insecure, is vulnerable t...