10663 matches found
XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is...
Synology Media Server 代码问题漏洞
Synology Media Server provides multimedia services for browsing and playing multimedia contents in Synology NAS via DLNA/UPnP home devices. A server-side request forgery vulnerability exists in the cgi component of Synology Media Server versions prior to 1.8.3-2881. A remote attacker can exploit...
CVE-2021-32690 Repository credentials passed to alternate domain
Helm is a tool for managing Charts packages of pre-configured Kubernetes resources. In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. Thi...
CVE-2021-31857
In Zoho ManageEngine Password Manager Pro before 11.1 build 11104, attackers are able to retrieve credentials via a browser extension for non-website resource types...
CVE-2021-31857
In Zoho ManageEngine Password Manager Pro before 11.1 build 11104, attackers are able to retrieve credentials via a browser extension for non-website resource types...
ZOHO ManageEngine Password Manager Pro 安全漏洞
ZOHO ManageEngine Password Manager Pro is a password manager from ZOHO USA. Additional vulnerabilities exist in Zoho ManageEngine Password Manager Pro. An attacker can use this vulnerability to obtain credentials for non-website resource types via a browser extension...
The vulnerability of the IBM DB2 database management system arises from the improper assignment of permissions for critical resources. This allows a perpetrator to gain unauthorized access to protected information or cause service failures.
The vulnerability of the IBM DB2 database management system is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or cause service failures by sending specially crafted...
CVE-2021-28169
For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. This can reveal...
CVE-2021-22181
A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 allows an attacker to create a recursive pipeline relationship and exhaust resources...
Denial of service
A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 allows an attacker to create a recursive pipeline relationship and exhaust resources...
CVE-2020-5003
IBM Financial Transaction Manager 3.2.4 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 192956...
Xxe
IBM Financial Transaction Manager 3.2.4 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 192956...
CVE-2020-5003
IBM Financial Transaction Manager 3.2.4 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 192956...
Information Disclosure
microcode is vulnerable to information disclosure. Improper isolation of shared resources in some IntelR Processors allows an authenticated user obtainc onfidential information disclosure via local access...
Information Disclosure
jetty-servlets is vulnerable to information disclosure. Lack of proper handling of requests to the ConcatServlet with a doubly encoded path allows an attacker to access protected resources within the WEB-INF directory. For example, sending /concat?/%2557EB-INF/web.xml can retrieve the web.xml fil...
servicemesh-operator: NetworkPolicy resources incorrectly specify ports for ingress resources
A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing access to all ports on these resources from any pod. The highest threat from this vulnerability is to data confidentiality and integrity as wel...
Unauthorized Access Vulnerability in Munin
Munin is a great easy to install and setup monitoring software that monitors core system resources including memory, disk, CPU usage, server applications such as MySQL, Apache, and Squid, and more. Munin suffers from an unauthorized access vulnerability that can be exploited by attackers to obtai...
DEBIAN-CVE-2020-24511
Improper isolation of shared resources in some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access...
