NodeSecurityShield - A Developer And Security Engineer Friendly Package For Securing NodeJS Applications

A Developer and Security Engineer friendly package for Securing NodeJS Applications. Inspired by the log4J vulnerability CVE-2021-44228 which can be exploited because an application can make arbitrary network calls. We felt there is an need for an application to declare what privileges it can hav...

Vulnerability of the Microsoft Office Graphics Package components in Microsoft Office programs, allowing a hacker to execute arbitrary code

The vulnerability of the Microsoft Office Graphics Package components in Microsoft Office products is related to access to resources through incompatible types. Exploiting this vulnerability could allow an attacker to execute arbitrary code in the context of the current user...

The vulnerability of JavaScript script handlers in Microsoft Edge and Google Chrome browsers allows attackers to disclose protected information.

The vulnerability of JavaScript script handlers in Microsoft Edge and Google Chrome browsers is related to access to resources through incompatible types. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information that is protected by these scripts...

CVE-2022-1316

Incorrect Permission Assignment for Critical Resource in GitHub repository zerotier/zerotierone prior to 1.8.8. Local Privilege Escalation...

多款Qualcomm产品配置错误漏洞

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way to miniaturize circuits mainly semiconductor devices, but also passive components, etc., and from time to time fabricated on the surface of semiconductor wafers. Qualcomm A misconfiguration vulnerability exists in multiple products,...

GHSA-6V73-FGF6-W5J7 Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources...

The vulnerability of the Spring module routing mechanism, which facilitates business logic through Spring Cloud Function services, allows attackers to gain unauthorized access to local resources or cause service failures.

The vulnerability of the Spring module routing mechanism for promoting business logic using Spring Cloud Function is related to deficiencies in the process of eliminating special elements from the output data used by the incoming component. Exploiting this vulnerability can allow an attacker to...

CVE-2021-3456

An improper authorization handling flaw was found in Foreman. The Salt plugin for the smart-proxy allows foreman clients to execute actions that should be limited to the Foreman Server. This flaw allows an authenticated local attacker to access and delete limited resources and also causes a denia...

CVE-2021-40061

There is a vulnerability of accessing resources using an incompatible type type confusion in the Bastet module. Successful exploitation of this vulnerability may affect integrity...

CVE-2021-40061

There is a vulnerability of accessing resources using an incompatible type type confusion in the Bastet module. Successful exploitation of this vulnerability may affect integrity...

USN-5313-1 openjdk-lts, openjdk-17 vulnerabilities

It was discovered that OpenJDK incorrectly handled deserialization filters. An attacker could possibly use this issue to insert, delete or obtain sensitive information. CVE-2022-21248 It was discovered that OpenJDK incorrectly read uncompressed TIFF files. An attacker could possibly use this issu...

CVE-2021-40046

PCManager versions 11.1.1.95 has a privilege escalation vulnerability. Successful exploit could allow the attacker to access certain resource beyond its privilege...

CVE-2021-40046

PCManager versions 11.1.1.95 has a privilege escalation vulnerability. Successful exploit could allow the attacker to access certain resource beyond its privilege...

Privilege escalation

PCManager versions 11.1.1.95 has a privilege escalation vulnerability. Successful exploit could allow the attacker to access certain resource beyond its privilege...

CVE-2021-40046

PCManager versions 11.1.1.95 has a privilege escalation vulnerability. Successful exploit could allow the attacker to access certain resource beyond its privilege...

Siemens Nucleus RTOS-based APOGEE and TALON Products Access of Resource Using Incompatible Type (CVE-2021-31344)

A vulnerability has been identified in APOGEE MBC PPC BACnet All versions, APOGEE MBC PPC P2 Ethernet All versions, APOGEE MEC PPC BACnet All versions, APOGEE MEC PPC P2 Ethernet All versions, APOGEE PXC Compact BACnet All versions = V2.3 and = V2.3 and = V2.3 and = V2.3 and = V2.3 and = V2.3 and...

GHSA-7MHC-PRGV-R3Q4 Access of Resource Using Incompatible Type in Hermes

By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error out on invalid await/yield positions. This could result in segmentation fault as a consequence of type confusion error,...

Lookup operations do not take into account wildcards in SpiceDB

Impact Any user making use of a wildcard relationship under the right hand branch of an exclusion or within an intersection operation will see Lookup/LookupResources return a resource as "accessible" if it is not accessible by virtue of the inclusion of the wildcard in the intersection or the rig...

CVE-2021-40037

There is a Vulnerability of accessing resources using an incompatible type type confusion in the MPTCP subsystem in smartphones. Successful exploitation of this vulnerability may cause the system to crash and restart...

BookStack 访问控制错误漏洞

BookStack is the BookStackApp team's set of open source platform for building wiki documents using PHP and Laravel. bookstack suffers from an access control error vulnerability that stems from a network system or product that does not properly restrict access to resources from unauthorized roles...