Improper Neutralization Of Special Elements In Output Used By A Downstream Component ('Injection')

Astro-Shield is vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection'. The vulnerability is caused due to inadequate validation of user-controlled content, potentially allowing the inclusion of malicious resources in the generated CSP heade...

GitLab Label Description Uncontrolled Resource Consumption Denial-of-Service Vulnerability

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of GitLab. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of label descriptions. By sending a crafted request, an attacker can consu...

The vulnerability of the chmod() method in the Apache Doris backend storage and frontend request handler, related to synchronization errors when using shared resources, allows attackers to compromise the integrity of the protected information.

The vulnerability of the chmod method in the Apache Doris backend and frontend request handlers is related to synchronization errors when using shared resources. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...

The vulnerability of the agent in the Zabbix monitoring system arises from the incorrect assignment of permissions for critical resources, allowing a perpetrator to execute arbitrary code.

The vulnerability of the Zabbix universal monitoring agent is related to the incorrect assignment of permissions for critical resources. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code...

The vulnerability of the Libvirt virtualization management library, related to the incorrect assignment of permissions to critical resources, allows a hacker to gain access to confidential information.

The vulnerability of the Libvirt virtualization management library is related to the creation of SELinux MCS category pairs for dynamic virtual machine tags. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information...

BIT-AIRFLOW-2024-28746 Apache Airflow: Ignored Airflow Permissions

Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access. Users of Apache Airflow are recommended to upgrade to...

CVE-2024-22353 IBM WebSphere Application Server Liberty denial of service

IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 280400...

CVE-2024-22353 IBM WebSphere Application Server Liberty denial of service

IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 280400...

Content-Security-Policy header generation in middleware could be compromised by malicious injections

Impact When the following conditions are met: - Automated CSP headers generation for SSR content is enabled - The web application serves content that can be partially controlled by external users Then it is possible that the CSP headers generation feature might be "allow-listing" malicious inject...

The Power of ISP Proxies: Unlocking Local Content and Resources

By Owais Sultan Modern advancements have tilted the world into a tightly-knit web. Accessing localized content and resources can be hard… This is a post from HackRead.com Read the original post: The Power of ISP Proxies: Unlocking Local Content and Resources...

Arbitrary Code Execution

@thi.ng/paths is vulnerable to arbitrary code execution. The vulnerability is due to improper control of dynamically-managed code resources due to the handling of object properties in the mutIn and mutInManyUnsafe methods...

CVE-2024-29896

Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the C...

CVE-2024-29896

CVE-2024-29896 affects the Astro-Shield library. The vulnerability stems from automated CSP header generation for SSR content, where the CSP header may inadvertently allowlisting malicious injected resources (e.g., inlined or external scripts) when content can be partially controlled by external ...

Denial Of Service (DoS)

Riverline/multipart-parser is vulnerable to Denial of Service DoS. The vulnerability is due to the lack of limits on the length of header lines, allowing attackers to overwhelm server resources by sending requests with exceptionally long headers, potentially leading to Denial of Service DoS...

Astro-Shield 安全漏洞

Astro-Shield is KindSpells Labs open source a library . It is used to calculate sub-resource integrity hashes for JS scripts and CSS stylesheets. Astro-Shield has a security vulnerability that stems from the CSP header generation feature allowing the listing of maliciously injected resources...

UBUNTU-CVE-2024-0077

NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, where it allows a guest OS to allocate resources for which the guest OS is not authorized. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information...

CVE-2024-20316

CVE-2024-20316 affects Cisco IOS XE Software with the Data Model Interface (DMI) when an IPv4 ACL is updated via NETCONF/RESTCONF. The issue stems from improper error handling that can reorder ACEs in an updated ACL, potentially allowing access to resources that should be protected. Concrete deta...

CVE-2023-6400

Incorrect Authorization vulnerability in OpenText™ ZENworks Configuration Management ZCM allows Unauthorized Use of Device Resources.This issue affects ZENworks Configuration Management ZCM versions: 2020 update 3, 23.3, and 23.4...

CVE-2023-6400 Incorrect user authorization vulnerability on OpenText ZENworks Configuration Management (ZCM) product.

Incorrect Authorization vulnerability in OpenText™ ZENworks Configuration Management ZCM allows Unauthorized Use of Device Resources.This issue affects ZENworks Configuration Management ZCM versions: 2020 update 3, 23.3, and 23.4...

CVE-2023-6400 Incorrect user authorization vulnerability on OpenText ZENworks Configuration Management (ZCM) product.

Incorrect Authorization vulnerability in OpenText™ ZENworks Configuration Management ZCM allows Unauthorized Use of Device Resources.This issue affects ZENworks Configuration Management ZCM versions: 2020 update 3, 23.3, and 23.4...