2110 matches found
PT-2022-22026 · WordPress · Ideastocode Enable Svg
Name of the Vulnerable Software and Affected Versions: ideasToCode Enable SVG, WebP & ICO Upload plugin version 1.0.1 and earlier Description: The issue allows authenticated users with author or higher roles to upload arbitrary files. This can be exploited by uploading malicious files to the...
Flarum 安全漏洞
Flarum is an open source forum system for the Flarum community. A security vulnerability exists in Flarum's Byobu extension prior to version 1.1.7, which stems from the fact that Byobu is a private discussion extension for the Flarum forums, and the affected version was found to not allow private...
CVE-2022-30316
Honeywell Experion PKS Safety Manager 5.02 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0054, there is a Honeywell Experion PKS Safety Manager unauthenticated firmware update issue. The affected components are characterized as: Firmware update functionality. The...
PT-2022-4030 · Jenkins · Jenkins Git Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins GitHub Plugin versions 1.34.4 and earlier Description: The issue is related to the disclosure of information through inconsistency. It allows a remote attacker to gain unauthorized access to protected information. The problem lies in...
Lack of authentication mechanism in git webhook
git provides a webhook endpoint at /git/notifyCommit that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In git 4.11....
java-1.8.0-openjdk security, bug fix, and enhancement update
1.8.0.342.b07-1.0.1 - Replace upstream references Orabug: 34340145 1:1.8.0.342.b07-1 - Update to shenandoah-jdk8u342-b07 - Update release notes for shenandoah-8u342-b07. - Print release file during build, which should now include a correct SOURCE value from .src-rev - Update tarball script with...
java-11-openjdk security, bug fix, and enhancement update
1:11.0.16.0.8-1.0.1 - Replace upstream references Orabug: 34340155 1:11.0.16.0.8-1 - Update to jdk-11.0.16+8 - Update release notes to 11.0.16+8 - Use same tarball naming style as java-17-openjdk and java-latest-openjdk - Drop JDK-8257794 patch now upstreamed - Print release file during build,...
java-1.8.0-openjdk security, bug fix, and enhancement update
1:1.8.0.342.b07-1 - Update to shenandoah-jdk8u342-b07 - Update release notes for shenandoah-8u342-b07. - Print release file during build, which should now include a correct SOURCE value from .src-rev - Update tarball script with IcedTea GitHub URL and .src-rev generation - Use 'git apply' with...
java-11-openjdk security, bug fix, and enhancement update
1:11.0.16.0.8-1.0.1 - link atomic for ix86 build 1:11.0.16.0.8-1 - Update to jdk-11.0.16+8 - Update release notes to 11.0.16+8 - Use same tarball naming style as java-17-openjdk and java-latest-openjdk - Drop JDK-8284920 patch now upstreamed - Print release file during build, which should now...
CVE-2022-34226 Adobe Acrobat Reader DC PDF Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Adobe Acrobat Reader versions 22.001.20142 and earlier, 20.005.30334 and earlier and 17.012.30229 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage thi...
PT-2022-21852 · Siemens · Opcenter Quality
Name of the Vulnerable Software and Affected Versions: Opcenter Quality versions prior to V13.1.20220624 Opcenter Quality versions prior to V13.2.20220624 Description: A vulnerability has been identified where the affected applications do not properly validate login information during...
Malicious Package
Overview @commercialsalesandmarketing/contact-search is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only...
EUVD-2022-53430
Microsoft Windows SMBv3 suffers from a null pointer dereference in versions of Windows prior to the April, 2022 patch set. By sending a malformed FileNormalizedNameInformation SMBv3 request over a named pipe, an attacker can cause a Blue Screen of Death BSOD crash of the Windows kernel. For most...
CVE-2022-32157
Splunk Enterprise deployment servers in versions before 9.0 allow unauthenticated downloading of forwarder bundles. Remediation requires you to update the deployment server to version 9.0 and Configure authentication for deployment servers and clients...
.NET 6.0 Update: June 14, 2022 (KB5015429)
None None...
SAP 3D Visual Enterprise Viewer 输入验证错误漏洞
SAP 3D Visual Enterprise Viewer is a 3D view viewer from SAP Germany. The software supports publishing 2D and 3D scenes in all industry-standard desktop applications and supports separate installations as standalone executables and ActiveX spaces. The vulnerability can be exploited to crash the...
ALPINE-CVE-2022-26363
x86 pv: Insufficient care with non-coherent mappings This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to...
PT-2022-19479 · Envoy · Envoy
Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.22.1 Description: The issue arises when the OAuth filter attempts to invoke remaining filters in the chain after a local response has been emitted. This can trigger an ASSERT in newer versions and corrupt memory in...
Use of Uninitialized Resource
Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource. When authenticating, a malicious server can return a specially crafted authentication packet, causing the client to read and return up to 12 bytes of data from an uninitialized variable in stack memory...