Jettison Vulnerability in Bitbucket Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 7.17.0, 7.21.0, 8.7.0, 8.8.0, 8.9.0, 8.10.0, 8.11.0, and 8.12.0 of Bitbucket Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

Cache Poisoning org.eclipse.jetty:jetty-server in Jira Software Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 8.20.0, 9.4.0, 9.5.0, 9.6.0, 9.7.0, 9.8.0, 9.9.0, 9.10.0, 9.10.1, and 9.11.0 of Jira Software Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

org.apache.velocity Vulnerability in Bitbucket Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 7.21.0, 7.21.1, 7.21.2, 7.21.3, 7.21.4, 7.21.5, 7.21.6, and 7.21.7 of Bitbucket Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 8.8 and a CVSS Vector of...

FALSE POSITIVE - OpenSearch Vulnerability in Bitbucket Data Center and Server

Notice of FALSE POSITIVE After review, it has been determined that CVE-2022-41906 DOES NOT affect ANY version of Bitbucket Data Center or Bitbucket Server. We have updated our bulletin and Jira tickets to reflect this update. We have taken action to prevent this false-positive from appearing in o...

Third-Party Dependency Vulnerability in Jira Service Management Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in version 4.20.0 of Jira Service Management Data Center and Server. This vulnerability, with CVSS Scores of 7.5, and CVSS Vectors of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, allows an unauthenticated attacker to expose...

updatedAt TIMESTAMP IS NOT USED TO DETECT STALE ORACLE PRICES

Lines of code Vulnerability details Impact The external Chainlink oracle, which provides index price information to the system, introduces risk inherent to any dependency on third-party data sources. For example, the oracle could fall behind or otherwise fail to be maintained, resulting in outdat...

CVE-2022-38778

A flaw was found in one of Kibana’s third-party dependencies. This issue could allow an authenticated user to perform a request that crashes the Kibana server process...

CVE-2022-38778

A flaw CVE-2022-38900 was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process...

CVE-2022-38778

A flaw CVE-2022-38900 was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process...

Deserialization of untrusted data in Apache Cayenne

Hessian serialization is a network protocol that supports object-based transmission. Apache Cayenne's optional Remote Object Persistence ROP feature is a web services-based technology that provides object persistence and query functionality to 'remote' applications. In Apache Cayenne 4.1 and...

CVE-2022-24289 Deserialization of untrusted data in the Hessian Component of Apache Cayenne 4.1 with older Java versions

Hessian serialization is a network protocol that supports object-based transmission. Apache Cayenne's optional Remote Object Persistence ROP feature is a web services-based technology that provides object persistence and query functionality to 'remote' applications. In Apache Cayenne 4.1 and...

SHOULD CHECK RETURN DATA FROM CHAINLINK AGGREGATORS

Handle defsec Vulnerability details Impact The latestRoundData function in the contract PriceFeed.sol fetches the asset price from a Chainlink aggregator using the latestRoundData function. However, there are no checks on roundID. Stale prices could put funds at risk. According to Chainlink's...

CVE-2021-31892

A vulnerability has been identified in SINUMERIK Analyse MyCondition All versions, SINUMERIK Analyze MyPerformance All versions, SINUMERIK Analyze MyPerformance /OEE-Monitor All versions, SINUMERIK Analyze MyPerformance /OEE-Tuning All versions, SINUMERIK Integrate Client 02 All versions =...

Design/Logic Flaw

A vulnerability has been identified in SINUMERIK Analyse MyCondition All versions, SINUMERIK Analyze MyPerformance All versions, SINUMERIK Analyze MyPerformance /OEE-Monitor All versions, SINUMERIK Analyze MyPerformance /OEE-Tuning All versions, SINUMERIK Integrate Client 02 All versions =...

CVE-2021-31892

Summary: CVE-2021-31892 affects Siemens SINUMERIK software families (MyCondition/Performance analyzers, various Integrate clients, Manage MyMachines, Operate, NX-Cam Editor, etc.). The root cause is an error in a third‑party dependency that overwrites TLS server‑certificate validation flags, enab...

Siemens SINUMERIK 信任管理问题漏洞

Siemens SINUMERIK is a control system from Siemens, Germany. It is used in all areas of production. A trust management issue vulnerability exists in Siemens SINUMERIK due to an error in a third-party dependency where the ssl flag used to set up a TLS connection to a server is incorrectly set to...

Siemens SINUMERIK Integrate Operate Client

1. EXECUTIVE SUMMARY CVSS v3 7.4 ATTENTION : Exploitable remotely Vendor : Siemens Equipment : SINUMERIK Integrate Operate Client Vulnerability : Improper Certificate Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to spoof any SSL server...

Barclaycart - Unauthenticated Shell Upload

The Barclaycart WordPress plugin was found to be vulnerable to an Unauthenticated Shell Upload security vulnerability, due to using a vulnerable version of the third-party uploadify dependency. This issue has been seen exploited in the wild. PoC "@$uploadfile",...