10652 matches found
GHSA-3QHM-QFJ3-4RRX elFinder Server Side Request Forgery (SSRF)
A Server Side Request Forgery SSRF vulnerability in elFinder before 2.1.49 could allow a malicious user to access the content of internal network resources. This occurs in getremotecontents in php/elFinder.class.php...
GHSA-RC2W-R4JQ-7PFX Improper Authorization in Apache Xalan-Java
The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURESECUREPROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted 1...
GHSA-Q6X7-F33R-3WXX Incorrect Authorization in Apache Tomcat
The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was...
GHSA-X6JW-2F23-MC5J Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to access plugin resource files in the META-INF and WEB-INF directories that should not be accessible, if the Jenkins home directory is on a case-insensitiv...
GHSA-5P59-V5WM-77V4 Improper Limitation of a Pathname to a Restricted Directory in Jenkins
Jenkins before 2.107 and Jenkins LTS before 2.89.4 did not properly prevent specifying relative paths that escape a base directory for URLs accessing plugin resource files. This allowed users with Overall/Read permission to download files from the Jenkins master they should not have access to. On...
GHSA-RQPH-VQWM-22VC Allocation of Resources Without Limits or Throttling in Spring Framework
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user...
Code injection
Allowing long password leads to denial of service in GitHub repository causefx/organizr prior to 2.1.2000. This vulnerability can be abused by doing a DDoS attack for which genuine users will not able to access resources/applications...
CVE-2022-29538
RESI Gemini-Net Web 4.2 is affected by Improper Access Control in authorization logic. An unauthenticated user is able to access some critical resources...
CVE-2022-29538
RESI Gemini-Net Web 4.2 is affected by Improper Access Control in authorization logic. An unauthenticated user is able to access some critical resources...
CVE-2022-29538
RESI Gemini-Net Web 4.2 is affected by Improper Access Control in authorization logic. An unauthenticated user is able to access some critical resources...
Improper access control
RESI Gemini-Net Web 4.2 is affected by Improper Access Control in authorization logic. An unauthenticated user is able to access some critical resources...
CVE-2022-29538
RESI Gemini-Net Web 4.2 is affected by Improper Access Control in authorization logic. An unauthenticated user is able to access some critical resources...
PT-2022-19688 · Resi · Resi Gemini-Net Web
Name of the Vulnerable Software and Affected Versions: RESI Gemini-Net Web version 4.2 Description: The issue is related to Improper Access Control in authorization logic, allowing an unauthenticated user to access some critical resources. Recommendations: For RESI Gemini-Net Web version 4.2,...
The vulnerability of the Windows Hyper-V hardware virtualization system allows attackers to escalate their privileges.
The vulnerability of the Windows Hyper-V hardware virtualization system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to gain increased privileges...
The vulnerability of the PlayTo Manager component for Windows operating systems allows attackers to escalate their privileges.
The vulnerability of the PlayTo Manager component for Windows operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to gain increased privileges...
RESI Gemini-Net 安全漏洞
RESI Gemini-Net is a technology from RESI Italy for active and passive monitoring of communication networks and services. A security vulnerability exists in RESI Gemini-Net Web version 4.2 that originates from improper access control in the authorization logic. An attacker could exploit the...
Microsoft Windows Storage Spaces Controller Elevation of Privilege Vulnerability (CNVD-2022-70064)
An elevation-of-privilege vulnerability exists in Microsoft Windows Storage Spaces Controller, a driver necessary to provide storage space functionality for Microsoft Corporation. The vulnerability stems from improper handling of concurrent access when concurrent code needs to mutually exclusive...
Microsoft Windows Push Notifications Elevation of Privilege Vulnerability
Microsoft Windows Push Notifications is a push notification service from Microsoft Corporation USA. It provides a reliable way to deliver new updates.Microsoft Windows Push Notifications suffers from an elevation of privilege vulnerability. The vulnerability stems from improper handling of...