CVE-2022-36094 XWiki Platform Web Parent POM vulnerable to XSS in the attachment history

XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascri...

PT-2022-23180 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki Platform Old Core versions prior to 13.1.0.5 and 14.3-rc-1 Description: The issue arises from missing checks for inactive users in XWiki, including the REST service, allowing a disabled user to enable themselves using a REST call. Some...

Wireshark 3.4.x < 3.4.16, 3.6.x < 3.6.8 DoS

The version of Wireshark installed on the remote Windows host is prior to 3.4.0 to 3.4.15 and 3.6.0 to 3.6.7. It is, therefore, affected by denial of service vulnerability as referenced in the wireshark-3.6.8 advisory. The F5 Ethernet Trailer dissector could go into an infinite loop. It may be...

The vulnerability of the BIOS microprogramming system of Intel Server Platform Services allows a perpetrator to trigger a service failure.

The vulnerability of the BIOS microprogramming system in Intel Server Platform Services is related to incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability can allow an attacker to cause service failures...

Wireshark 3.4.x < 3.4.16 A Vulnerability (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 3.4.16. It is, therefore, affected by a vulnerability as referenced in the wireshark-3.4.16 advisory. - Infinite loop in the F5 Ethernet Trailer protocol dissector in Wireshark 3.6.0 to 3.6.7 and 3.4.0 to 3.4.15...

Wireshark 3.6.x < 3.6.8 A Vulnerability (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 3.6.8. It is, therefore, affected by a vulnerability as referenced in the wireshark-3.6.8 advisory. - The F5 Ethernet Trailer dissector could go into an infinite loop. It may be possible to make Wireshark consume...

Wireshark 3.4.x < 3.4.16 A Vulnerability

The version of Wireshark installed on the remote Windows host is prior to 3.4.16. It is, therefore, affected by a vulnerability as referenced in the wireshark-3.4.16 advisory. - Infinite loop in the F5 Ethernet Trailer protocol dissector in Wireshark 3.6.0 to 3.6.7 and 3.4.0 to 3.4.15 allows deni...

CVE-2022-23451

An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data,...

PublicCMS server-side request forgery vulnerability

PublicCMS is an open source content management system CMS written in Java by PublicCMS, China. publicCMS 4.0.202011.b previous versions exist server-side request forgery vulnerability, the vulnerability stems from the file parameter for access to the IP and domain name is not restricted. An...

IBM Cognos Analytics has an unspecified vulnerability (CNVD-2022-62227)

IBM Cognos Analytics is a suite of business intelligence software from IBM Corporation of the United States. IBM Cognos Analytics versions 11.1.7, 11.2.0 and 11.2.1 contain a security vulnerability that stems from vulnerability to XML External Entity Injection XXE attacks when working with XML...

PublicCMS 代码问题漏洞

PublicCMS is an open source content management system CMS written in Java by PublicCMS, China. publicCMS 4.0.202011.b previous versions exist server-side request forgery vulnerability, the vulnerability stems from the file parameter for access to the IP and domain name is not restricted. An...

The vulnerability of the client_golang library in the monitoring and event-notification application of Prometheus allows a intruder to trigger a service failure.

The vulnerability of the clientgolang library used in Prometheus’s monitoring and event notification applications relates to the unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

CVE-2022-36773

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 233571...

CVE-2022-30614

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to a denial of service via email flooding caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume all available CPU resources. IBM X-Force ID: 227591...

CVE-2022-36773

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 233571...

CVE-2022-30614

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to a denial of service via email flooding caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume all available CPU resources. IBM X-Force ID: 227591...

The vulnerability of the mlx5 driver for libraries and drivers for fast packet processing in DPDK allows the attacker to trigger a service failure.

The vulnerability of the mlx5 driver for libraries and drivers used in fast packet processing in DPDK is related to unlimited resource allocation. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability in the arch/x86/kvm/lapic.c component of the KVM virtualization subsystem in the Linux operating system’s kernel allows a attacker to cause a service failure.

The vulnerability in the kvmfreelapic function of the arch/x86/kvm/lapic.c component of the KVM virtualization subsystem in the Linux operating system is related to incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability can allow an attacker to cause a service failu...

The vulnerability of the copy_desc_to_mbuf() function in the set of libraries and drivers for fast packet processing in dpdk allows the attacker to cause a service failure.

The vulnerability of the copydesctombuf function, which is part of a set of libraries and drivers for fast packet processing in dpdk, is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

PT-2022-4616 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 10.0 through 15.1.5 GitLab CE/EE versions 15.2 through 15.2.3 GitLab CE/EE versions 15.3 through 15.3.1 Description: A business logic issue in the handling of large repositories allowed an authenticated and authorized us...