CVE-2022-38648

Server-Side Request Forgery SSRF vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14...

Server side request forgery (ssrf)

Server-Side Request Forgery SSRF vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14...

UBUNTU-CVE-2022-38648

Server-Side Request Forgery SSRF vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14...

IT Security Takeaways from the Wiseasy Hack

Last month Tech Crunch reported that payment terminal manufacturer Wiseasy had been hacked. Although Wiseasy might not be well known in North America, their Android-based payment terminals are widely used in the Asia Pacific region and hackers managed to steal passwords for 140,000 payment...

PT-2022-24497 · Apache +5 · Apache Xml Graphics Batik +5

Name of the Vulnerable Software and Affected Versions: Apache XML Graphics Batik version 1.14 Description: A Server-Side Request Forgery SSRF issue allows an attacker to fetch external resources. This can be exploited by an attacker to access resources that should not be accessible...

Apache XML Graphics Batik 代码问题漏洞

Apache XML Graphics Batik is a Java-based application from the Apache Foundation that is primarily used to process images in SVG format. Apache XML Graphics Batik is vulnerable to server-side request forgery, which is caused by a flaw when calling the fop function. An attacker could exploit the...

CVE-2022-38648 PDFTranscoder does not block external resources

Server-Side Request Forgery SSRF vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14...

Input validation

Improper detection of complete HTTP body decompression SwiftNIO Extras provides a pair of helpers for transparently decompressing received HTTP request or response bodies. These two objects HTTPRequestDecompressor and HTTPResponseDecompressor both failed to detect when the decompressed body was...

Memory corruption

By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources...

CVE-2022-38178 Memory leaks in EdDSA DNSSEC verification code

By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources...

CVE-2022-38177

By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources...

Why Organizations Struggle with Patch Management (and What to Do about It)

The cybersecurity attack surface continues to grow exponentially. Modern technologies are being deployed on-premises and in the cloud as part of digital transformation journeys. Meanwhile, the current practice of identifying, classifying, prioritizing, and remediating vulnerabilities has become...

Microsoft Endpoint Configuration Manager 安全漏洞

Microsoft Endpoint Configuration Manager is a local management solution from Microsoft. It is used to manage networked or Internet-based desktops, servers, and laptops. A security vulnerability exists in Microsoft Endpoint Configuration Manager, which can be exploited by an attacker to gain acces...

mrtoilet.or.kr Cross Site Scripting vulnerability OBB-2934329

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-3225

Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20...

Improper access control

Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20...

CVE-2022-3225

CVE-2022-3225 affects budibase/budibase prior to 1.3.20, described as Improper Control of Dynamically-Managed Code Resources with an associated access-control weakness. The public documents also annotate this as an Improper Access Control vulnerability (GHSA and related advisories). Root cause ci...

CVE-2022-3225 Improper Control of Dynamically-Managed Code Resources in budibase/budibase

Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20...

GHSA-2JV3-V37P-65W3 CrafterCMS Crafter Studio Improperly Controls Dynamically-Managed Code Resources

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI...

GHSA-J6X3-3JQQ-M922 CrafterCMS OS Command Injection vulnerability

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass...