Trigger `beforeFind` not invoked in internal query pipeline when fetching pointer

Impact A Parse Pointer can be used to access internal Parse Server classes. It can also be used to circumvent the beforeFind query trigger which can be an additional vulnerability for deployments where the beforeFind trigger is used as a security layer to modify an incoming query. Patches The...

Path traversal

An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is Path Traversal via the "restore SQL data" filename. The Vocera Report Console contains a websocket function that allows for the restoration of the database from a ZIP archive that expects a SQL import file...

Memory corruption

An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. Internal users with administrator privileges, @cbq-engine-cbauth and @index-cbauth, leak credentials in cleartext in the indexer.log file when they make a /listCreateTokens, /listRebalanceTokens, or...

Authentication flaw

An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leaked authentication information being stored in cleartext in the debug.log and info.log files, and is also shown in the UI visible to administrators...

Sambar Server 5.x results.stm Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6643/info Sambar Server does not adequately filter some HTML code thus making it prone to cross-site scripting attacks. It is possible for a remote attacker to create a malicious link containing script code which will be...

Sambar security quest

This issue is old originally discovered in January, 2003 published by iDefense1 and fixed by Vendor2 in September, 2003 but still interesting if you tired of endless crossite scriptings, buffer overflows and SQL injections and would like to play security game. Intro: Probably you heard about...

CVE-2001-0847

CVE-2001-0847 affects Lotus Domino Web Server 5.x. The vulnerability allows remote attackers to disclose sensitive information by accessing the default navigator $defaultNav, either by URL-encoding the request or by directly requesting the ReplicaID. The public records describe the affected compo...