CVE-2022-0239

corenlp is vulnerable to Improper Restriction of XML External Entity Reference...

CVE-2022-0239

The CVE-2022-0239 entry pertains to Stanford CoreNLP (corenlp) with an XML External Entity (XXE) processing flaw. Root cause: SchemaFactory is created without secure processing enabled and is used to validate XML against a schema, enabling XXE when processing malicious XML. Impact (per public rec...

CVE-2022-0239 Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp

corenlp is vulnerable to Improper Restriction of XML External Entity Reference...

The vulnerability of the sound output utility, which uses the computer’s built-in speaker to emit beeps, stems from deficiencies in path name restriction. This allows a violator to trigger a service failure.

The vulnerability of the sound output utility, which uses the computer’s built-in speaker for beeping, is related to deficiencies in path name restriction. Exploiting this vulnerability could allow a hacker to cause a service failure...

CVE-2021-0959

In jitmemoryregion.cc, there is a possible bypass of memory restrictions due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID:...

ROS-20220114-01

Vulnerability in Firefox browser, related to incorrect processing of user data. of user data. Exploitation of the vulnerability could allow an attacker acting remotely to mislead, by showing an incorrect origin when requesting to run a program and processing an external URL protocol Firefox brows...

CVE-2022-0198

corenlp is vulnerable to Improper Restriction of XML External Entity Reference...

CVE-2022-0198

corenlp is vulnerable to Improper Restriction of XML External Entity Reference...

FreeBSD : Gitlab -- Multiple Vulnerabilities (43f84437-73ab-11ec-a587-001b217b3468)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 43f84437-73ab-11ec-a587-001b217b3468 advisory. - Gitlab reports: Arbitrary file read via group import feature Stored XSS in notes Lack of sta...

PT-2022-1433 · Cisco · Cisco Ece

Name of the Vulnerable Software and Affected Versions: Cisco ECE affected versions not specified Description: A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. This is due to improper input validation...

Samba competition condition issue vulnerability

Samba is a standard Windows interoperability suite for Linux and Unix. A post-link vulnerability exists in Samba file server that results from a symbolic link contention condition when creating directories. A remote authenticated user can create a directory on a Unix file system outside of the...

PT-2022-1567 · Microsoft · Windows Installer +1

Name of the Vulnerable Software and Affected Versions: Windows Installer affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows Installer component of Windows operating systems. This can be exploited to elevate privileges. An...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Arbitrary file read via group import feature Stored XSS in notes Lack of state parameter on GitHub import project OAuth Vulnerability related fields are available to unauthorized users on GraphQL API Deleting packages may cause table locks IP restriction bypass via GraphQL...

CVE-2021-21408 Access to restricted PHP code by dynamic static class access in smarty

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch...

PT-2022-9072 · Schlage +1 · Schlage Be468 +1

Name of the Vulnerable Software and Affected Versions: Z-Wave devices based on Silicon Labs 500 series chipsets Schlage BE468 version 3.42 Description: The issue affects Z-Wave devices that use S0 authentication, leading to uncontrolled resource consumption and resulting in battery exhaustion. Fo...

PT-2022-6514

Name of the Vulnerable Software and Affected Versions Arm Mali GPU Kernel Driver versions r26p0 through r31p0 Arm Mali GPU Kernel Driver versions r0p0 through r35p0 Arm Mali GPU Kernel Driver versions r19p0 through r35p0 Description The Arm Mali GPU Kernel Driver has a vulnerability related to...

DayByDay CRM Information Disclosure Vulnerability (CNVD-2022-68548)

DayByDay CRM is an open source CRM Customer Relationship Management software, based on Laravel, that helps users keep track of clients, tasks, meetings and more. DayByDay CRM Information Disclosure Vulnerability, the vulnerability stems from the product's failure to add an effective restriction o...

DayByDay CRM Information Disclosure Vulnerability

DayByDay CRM is an open source CRM Customer Relationship Management software, based on Laravel, that helps users keep track of clients, tasks, meetings and more. DayByDay CRM Information Disclosure Vulnerability, the vulnerability stems from the product's failure to add an effective restriction o...

PT-2022-11382 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak versions 12.0.0 through 15.1.1 Description: A flaw was found in Keycloak that allows an attacker with any existing user account to create new default user accounts via the administrative REST API, even when new user registration is...

Vulnerabilities fixed in HCL Technologies Digital Experience

A Server Side Request Forgery SSRF vulnerability has been fixed in HCL Technologies Digital Experience formerly known as IBM WebSphere Portal. The vulnerability potentially allows a malicious person able to gain access to systems that they initially should not have access to. The researchers who...