3854 matches found
Cloudflare Public Bug Bounty: YAML schema injection risk in Swagger UI via schema_url parameter at developers.cloudflare.com
Vulnerability description not provided...
postgresql: schema_element defeats protective search_path changes
A flaw was found in PostgreSQL. Certain database calls could permit an attacker with elevated database-level privileges to execute arbitrary code...
GHSA-6F9P-G466-F8V8 blamer vulnerable to Arbitrary Argument Injection via the blameByFile() API
Versions of the blamer package before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the...
Apollo Router Unnamed "Subscription" operation results in Denial-of-Service
Impact This is a Denial-of-Service DoS type vulnerability which causes the Router to panic and terminate when GraphQL Subscriptions are enabled. It can be triggered when all of the following conditions are met: 1. Running Apollo Router v1.28.0, v1.28.1 or v1.29.0 "impacted versions"; and 2. The...
Oracle Linux 7 : kubernetes (ELSA-2019-4716)
The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-4716 advisory. - OLCNE-494 CVE-2019-11244 fix CVE-2019-11244: 'kubectl --http-cache=' Tenable has extracted the preceding description block directly from the Oracle Linux...
CVE-2023-41317 Unnamed "Subscription" operation results in Denial-of-Service in apollographql/router
The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Affected versions are subject to a Denial-of-Service DoS type vulnerability which causes the Router to panic and terminate when GraphQL Subscriptions are...
This Week in Spring - September 5th, 2023
Hi, Spring fans! Welcome to another installment of This Week in Spring! How are you? I just got back from another fabulous labor day weekend, and am headed to Oslo, Norway, for the fabulous JavaZone 2023 event. This will be my first time returning to lovely Oslo, Norway, since the pandemic! I can...
DDFFileParser is vulnerable to XXE Attacks
Impact DDFFileParser and DefaultDDFFileValidator and so ObjectLoader are vulnerable to XXE AttacksProcessing. DDF file is a LWM2M format used to store LWM2M object description. Leshan users are impacted only if they parse untrusted DDF files e.g. if they let external users provide their own model...
CVE-2023-41034
Eclipse Leshan is a device management server and client Java implementation. In affected versions DDFFileParser and DefaultDDFFileValidator and so ObjectLoader are vulnerable to XXE Attacks. A DDF file is a LWM2M format used to store LWM2M object description. Leshan users are impacted only if the...
Prevent logging invalid header values
Impact What kind of vulnerability is it? Apollo Server can log sensitive information Studio API keys if they are passed incorrectly with leading/trailing whitespace or if they have any characters that are invalid as part of a header value. Who is impacted? Users who all of the below: use either t...
PT-2023-33035 · Unknown · Apollo Server
Name of the Vulnerable Software and Affected Versions: Apollo Server versions prior to the latest version Description: The issue concerns Apollo Server logging sensitive information, specifically Studio API keys, under certain conditions. This occurs when API keys are passed with leading or...
Spring Data JDBC - How To Maintain Your Database Schema
This is the fifth article of a series about how to tackle various challenges you might encounter when using Spring Data JDBC. The series consists of: 1. Spring Data JDBC - How to use custom ID generation? 2. Spring Data JDBC - How do I make bidirectional relationships?. 3. Spring Data JDBC - How ...
Dell PowerScale OneFS elevation of privilege vulnerability (CNVD-2023-65218)
Dell PowerScale OneFS is an operating system from Dell USA. PowerScale OneFS operating system that provides horizontal scaling of NAS. An elevation of privilege vulnerability exists in Dell PowerScale OneFS, which can be exploited by an attacker to bypass schema protection and gain elevated...
Dell PowerScale OneFS 安全漏洞
Dell PowerScale OneFS is an operating system from Dell USA. PowerScale OneFS operating system that provides horizontal scaling of NAS. An elevation of privilege vulnerability exists in Dell PowerScale OneFS, which can be exploited by an attacker to bypass schema protection and gain elevated...
How to add custom text or a disclaimer to a login schema
How to add a custom text / Disclaimer to the XML file of a login schema...
Oracle Linux 8 : postgresql:13 (ELSA-2023-4527)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-4527 advisory. pgaudit pgrepack postgres-decoderbufs postgresql 13.11-1.0.1 - Update to 13.11 - Resolves: 2212815 - Update postgresql-setup to 8.7...
postgresql: schema_element defeats protective search_path changes
A flaw was found in PostgreSQL. Certain database calls could permit an attacker with elevated database-level privileges to execute arbitrary code...
postgresql: schema_element defeats protective search_path changes
A flaw was found in PostgreSQL. Certain database calls could permit an attacker with elevated database-level privileges to execute arbitrary code...
postgresql: schema_element defeats protective search_path changes
A flaw was found in PostgreSQL. Certain database calls could permit an attacker with elevated database-level privileges to execute arbitrary code...