21081 matches found
Security Bulletin: IBM Rational Build Forge 8.0.0.24 addresses multiple vulnerabilities by updating Apache Tomcat Server
Summary Security Bulletin: IBM Rational Build Forge 8.0.0.24 addresses multiple vulnerabilities by updating Apache Tomcat Server Vulnerability Details CVEID:CVE-2023-28708 DESCRIPTION: Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by the missing of secure...
generator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character
JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces t...
GHSA-4GPM-R23H-GPRW generator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character
JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces t...
Design/Logic Flaw
JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces t...
SUSE CVE-2022-24999
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an proto key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string ...
CVE-2023-46378
Stored Cross Site Scripting XSS vulnerability in MiniCMS 1.1.1 allows attackers to run arbitrary code via crafted string appended to /mc-admin/conf.php...
CVE-2015-20110
JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces t...
MiniCMS 跨站脚本漏洞
MiniCMS is the minimalist content management system for personal websites. A cross-site scripting vulnerability exists in MiniCMS version 1.11, which stems from the application's lack of effective filtering and escaping of user-supplied data, and can be exploited by an attacker to run arbitrary...
CVE-2023-46378
Stored Cross Site Scripting XSS vulnerability in MiniCMS 1.1.1 allows attackers to run arbitrary code via crafted string appended to /mc-admin/conf.php...
CVE-2015-20110
JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces t...
SpiceDB Log Information Disclosure Vulnerability
SpiceDB is a fine-grained permissions database inspired by Google Zanzibar. A log message disclosure vulnerability exists in SpiceDB versions prior to 1.27.0, which stems from the fact that SPICEDBDATASTORECONNURI is disclosed when the URI cannot be resolved, displaying the password in the log...
CVE-2023-46378
Stored Cross Site Scripting XSS vulnerability in MiniCMS 1.1.1 allows attackers to run arbitrary code via crafted string appended to /mc-admin/conf.php...
GLSA-202310-17 : UnZip: Multiple Vulnerabilities
The remote host is affected by the vulnerability described in GLSA-202310-17 UnZip: Multiple Vulnerabilities - A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to...
string-emil.de Improper Access Control vulnerability OBB-3767828
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2023-40121
In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation...
CVE-2022-34886
A remote code execution vulnerability was found in the firmware used in some Lenovo printers, which can be caused by a remote user pushing an illegal string to the server-side interface via a script, resulting in a stack overflow...
Lenovo printers input validation error vulnerability
Lenovo printers is a printer from the Chinese company Lenovo. Lenovo printers suffers from an input validation error vulnerability that originates from a user being able to send an illegal or incorrectly formatted string to an open port, resulting in a denial of service...
Lenovo printers security breach
Lenovo printers is a printer from the Chinese company Lenovo. A security vulnerability exists in Lenovo printers that originates from a remote code execution vulnerability due to a stack overflow caused by an illegal string being pushed through a script to the server-side interface...