31335 matches found
CVE-2024-27105 Frappe File Permissions can by bypassed using certain endpoints
Frappe is a full-stack web application framework. Prior to versions 14.66.3 and 15.16.0, file permission can be bypassed using certain endpoints, granting less privileged users permission to delete or clone a file. Versions 14.66.3 and 15.16.0 contain a patch for this issue. No known workarounds...
CVE-2024-24813 Frappe SQL Injection from reporting logic
Frappe is a full-stack web application framework. Prior to versions 14.64.0 and 15.0.0, SQL injection from a particular whitelisted method can result in access to data which the user doesn't have permission to access. Versions 14.64.0 and 15.0.0 contain a patch for this issue. No known workaround...
CVE-2024-23821 GeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS)
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting XSS vulnerability exists in versions prior to 2.23.4 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a...
CVE-2024-23818 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in WMS OpenLayers Format
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting XSS vulnerability exists in versions prior to 2.23.3 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a...
[SECURITY] Fedora 39 Update: libvirt-9.7.0-3.fc39
Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes. The main package includes the libvirtd server exporting the virtualization support...
Security Bulletin: IBM InfoSphere Information Server is affected by a denial of service vulnerability in Spring Framework (CVE-2023-34053)
Summary A denial of service vulnerability in Spring Framework used by IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2023-34053 DESCRIPTION: VMware Tanzu Spring Framework is vulnerable to a denial of service, caused by a flaw when the application uses Spring MVC ...
Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in Pallets Werkzeug (CVE-2023-46136)
Summary A vulnerability in Pallets Werkzeug used by IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2023-46136 DESCRIPTION: Pallets Werkzeug is vulnerable to a denial of service, caused by a flaw when parsing multipart/form-data containing a large part with CR/LF...
Security Bulletin: A denial of service vulnerability in WebSphere Application Server Liberty affects IBM InfoSphere Information Server (CVE-2023-44487)
Summary A denial of service vulnerability in WebSphere Application Server Liberty that is used by IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2023-44487 DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by a flaw in handling multiplex...
PT-2024-21619 · Olive Themes · Olive One Click Demo Import
Name of the Vulnerable Software and Affected Versions: Olive One Click Demo Import versions 1.1.1 and earlier Description: The issue is related to a Missing Authorization vulnerability in Olive Themes Olive One Click Demo Import, which allows importing settings and data. This can ultimately lead ...
Security Bulletin: IBM InfoSphere Information Server is affected by OpenSSL Vulnerability (CVE-2023-2650)
Summary A vulnerability in OpenSSL used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2023-2650 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw when using OBJobj2txt directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CM...
CVE-2024-29027 Parse Server crash and RCE via invalid Cloud Function or Cloud Job name
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-alpha.29, calling an invalid Parse Server Cloud Function name or Cloud Job name crashes the server and may allow for code injection, internal store manipulatio...
CVE-2020-24330 affecting package trousers for versions less than 0.3.14-7
CVE-2020-24330 affecting package trousers for versions less than 0.3.14-7. A patched version of the package is available...
CVE-2020-24332 affecting package trousers for versions less than 0.3.14-7
CVE-2020-24332 affecting package trousers for versions less than 0.3.14-7. A patched version of the package is available...
CVE-2023-38712 affecting package libreswan for versions less than 4.7-6
CVE-2023-38712 affecting package libreswan for versions less than 4.7-6. A patched version of the package is available...
CVE-2022-40320 affecting package libconfuse for versions less than 3.3-2
CVE-2022-40320 affecting package libconfuse for versions less than 3.3-2. A patched version of the package is available...
CVE-2022-36648 affecting package qemu for versions less than 6.2.0-18
CVE-2022-36648 affecting package qemu for versions less than 6.2.0-18. A patched version of the package is available...
CVE-2017-3607 affecting package libdb for versions less than 5.3.28-7
CVE-2017-3607 affecting package libdb for versions less than 5.3.28-7. A patched version of the package is available...
CVE-2023-39325 affecting package golang for versions less than 1.20.7-2
CVE-2023-39325 affecting package golang for versions less than 1.20.7-2. A patched version of the package is available...