The vulnerability of the Dovecot mail server’s passdb account database allows a hacker to escalate their privileges.

The vulnerability of the Dovecot mail server’s passdb database account database is related to configuration errors. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

UBUNTU-CVE-2022-2048

In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources lef...

SUSE-SU-2022:2297-1 Security update for python-Twisted

This update for python-Twisted fixes the following issues: - CVE-2022-21716: Fixed that ssh server accepts an infinite amount of data using all the available memory bsc1196739...

The vulnerability of the mod_lua module in the Apache HTTP Server allows a hacker to cause a service failure.

The vulnerability of the modlua module in the Apache HTTP Server is related to the unlimited distribution of resources when processing the function with zero parameter r:parsebody0. Exploiting this vulnerability allows a malicious actor to cause service failures by sending a specially crafted HTT...

CVE-2022-34471

When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest. If the manifest had been tampered with on the server, an attacker could trick the browser into downgrading the addon to a prior version. This...

CVE-2014-3648

The simplepush server iterates through the application installations and pushes a notification to the server provided by deviceToken. But this is user controlled. If a bogus applications is registered with bad deviceTokens, one can generate endless exceptions when those endpoints can't be reached...

OpenSSL -- Heap memory corruption with RSA private key operation

The OpenSSL project reports: The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X8664 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during t...

CVE-2017-20117 TrueConf Server group DOM cross site scripting

A vulnerability was found in TrueConf Server 4.3.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/group. The manipulation leads to basic cross site scripting DOM. The attack can be launched remotely. The exploit has been disclos...

CVE-2017-20115 TrueConf Server Reflected cross site scripting

A vulnerability was found in TrueConf Server 4.3.7 and classified as problematic. This issue affects some unknown processing of the file /admin/conferences/list/. The manipulation of the argument sort leads to basic cross site scripting Reflected. The attack may be initiated remotely. The exploit...

CVE-2017-20114 TrueConf Server Reflected cross site scripting

A vulnerability has been found in TrueConf Server 4.3.7 and classified as problematic. This vulnerability affects unknown code of the file /admin/conferences/get-all-status/. The manipulation of the argument keys leads to basic cross site scripting Reflected. The attack can be initiated remotely...

CVE-2017-20113 TrueConf Server Stored cross site scripting

A vulnerability, which was classified as problematic, was found in TrueConf Server 4.3.7. This affects an unknown part. The manipulation leads to basic cross site scripting Stored. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used...

Authorization

ApiFest OAuth 2.0 Server 0.3.1 does not validate the redirect URI in accordance with RFC 6749 and is susceptible to an open redirector attack. Specifically, it directly sends an authorization code to the redirect URI submitted with the authorization request, without checking whether the redirect...

CVE-2022-32535

The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 runs its web server with root privilege. In combination with CVE-2022-23534 this could give an attacker root access to the switch...

The vulnerability of server-based corporate software for monitoring and managing project knowledge bases in Adobe RoboHelp Server stems from deficiencies in the authentication process, allowing unauthorized users to escalate their privileges.

The vulnerability of server-based corporate software for project monitoring and management in Adobe RoboHelp Server is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to increase their privileges remotely...

Uncontrolled Resource Consumption in OPCFoundation.NetStandard.Opc.Ua.Core

A vulnerability was discovered in the OPC UA .NET Standard Stack that allows a malicious client to cause a server to trigger an out of memory exception by sending a large number of message chunks...

CVE-2021-45025

ASG technologies A Rocket Software Company ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cleartext Storage of Sensitive Information in a Cookie...

BitTorrent uTorrent 安全漏洞

BitTorrent uTorrent is a suite of BitTorrent client software written in C++ by the American company BitTorrent. A security vulnerability exists in BitTorrent uTorrent that stems from some unknown functionality of the component JSON RPC server. A remote attacker could exploit the vulnerability to...

CVE-2022-32261

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application contains a misconfiguration in the APT update. This could allow an attacker to add insecure packages to the application...

CVE-2022-27219

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.0 SP2. Affected application is missing general HTTP security headers in the web server configured on port 443. This could aid attackers by making the servers more prone to clickjacking, channel downgrade attacks a...

Directory traversal

Directory traversal vulnerability in T&D Data Server Japanese Edition Ver.2.22 and earlier, T&D Data Server English Edition Ver.2.30 and earlier, THERMO RECORDER DATA SERVER Japanese Edition Ver.2.13 and earlier, and THERMO RECORDER DATA SERVER English Edition Ver.2.13 and earlier allows a remote...