9377 matches found
fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime
Summary Fuzz testing on crossplane/crossplane, by Ada Logics and sponsored by the CNCF, identified input to a function in the fieldpath package that can cause an out of memory panic. Applications that use the Paved type's SetValue method with user provided input without proper validation might us...
GHSA-VFVJ-3M3G-M532 fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime
Summary Fuzz testing on crossplane/crossplane, by Ada Logics and sponsored by the CNCF, identified input to a function in the fieldpath package that can cause an out of memory panic. Applications that use the Paved type's SetValue method with user provided input without proper validation might us...
Exploit for Incorrect Authorization in Cacti
CVE-2022-46169 PoC: Authentication Bypass and Remote Code Exec...
Crossplane-runtime contains Improper Input Validation via Compositions
Summary Fuzz testing, by Ada Logics and sponsored by the CNCF, identified a vulnerability in the fieldpath package from crossplane/crossplane-runtime that an already highly privileged Crossplane user able to create or update Compositions could leverage to cause an out of memory panic in Crossplan...
GHSA-V829-X6HH-CQFQ Crossplane-runtime contains Improper Input Validation via Compositions
Summary Fuzz testing, by Ada Logics and sponsored by the CNCF, identified a vulnerability in the fieldpath package from crossplane/crossplane-runtime that an already highly privileged Crossplane user able to create or update Compositions could leverage to cause an out of memory panic in Crossplan...
CVE-2023-1300
A vulnerability classified as critical was found in SourceCodester COVID 19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file patient-report.php of the component POST Parameter Handler. The manipulation of the argument searchdata leads to sql...
CVE-2023-1300 SourceCodester COVID 19 Testing Management System POST Parameter patient-report.php sql injection
A vulnerability classified as critical was found in SourceCodester COVID 19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file patient-report.php of the component POST Parameter Handler. The manipulation of the argument searchdata leads to sql...
CVE-2023-1300
CVE-2023-1300 affects SourceCodester COVID 19 Testing Management System 1.0 in the file patient-report.php (POST Parameter Handler). The vulnerability is an SQL injection triggered by manipulating the searchdata parameter, exploitable remotely and publicly disclosed. Evidence from multiple source...
CVE-2023-25814
metersphere is an open source continuous testing platform. In versions prior to 2.7.1 a user who has permission to create a resource file through UI operations is able to append a path to their submission query which will be read by the system and displayed to the user. This allows a users of the...
CVE-2023-25573
metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in /api/jmeter/download/files, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This...
Improper access control
metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in /api/jmeter/download/files, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This...
CVE-2023-25814
Vulnerability overview (CVE-2023-25814) : metersphere prior to 2.7.1 allows a user with UI-created resource file permission to append a path to their submission query, which is then read and displayed by the system, enabling read access to arbitrary server filesystem files if the server process h...
CVE-2023-25573
Metersphere contains an improper access control vulnerability: unauthenticated users can download arbitrary files via /api/jmeter/download/files, exposing sensitive data. Affected versions include those prior to the fixes, with remediation in versions 1.20.20 lts and 2.7.1. The issue stems from i...
PT-2023-16872 · Sourcecodester · Sourcecodester Covid 19 Testing Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester COVID 19 Testing Management System version 1.0 Description: A critical issue was found in the COVID 19 Testing Management System, affecting an unknown functionality of the patient-report.php file, specifically in the POST...
CVE-2023-1300: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in SourceCodester COVID 19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file patient-report.php of the component POST Parameter Handler. The manipulation of the argument searchdata leads to sql...
Sourcecodester COVID 19 Testing Management System SQL Injection Vulnerability
Sourcecodester COVID 19 Testing Management System is a web-based application that provides an online platform for personal and Covid test administration to manage individual testing processes and results. A SQL injection vulnerability exists in SourceCodester COVID 19 Testing Management System...
The US Air Force Is Moving Fast on AI-Piloted Fighter Jets
After successful autonomous flight tests in December, the military is ramping up its plans to bring artificial intelligence to the skies...
Debian: Security Advisory (DSA-2104-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
This Week in Spring - March 7th, 2023
Hi, Spring fans! Welcome to another installment of This Week in Spring! It's an amazing week, and this week we've got a lot to look at. Let's dive right into it. Spring Cloud Function for Azure Function Spring Data 2022.0.3 and 2021.2.9 released Spring R2DBC for Reactive Relational Databases in...
