49 matches found
K99038439: NodeJS vulnerability CVE-2012-2330
Security Advisory Description The Update method in src/nodehttpparser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information request header contents and possibly spoof HTTP headers via a zero...
Description of the security update for Office Web Apps Server 2013: November 8, 2022 (KB5002261)
None None...
CVE-2022-36101 Sensitive data in backend customer module
Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration contained sensitive data like the hashed password and the session ID. These fields are now explicitly unset in version 5.7.15. Users are advised to update an...
H3C GR-1200W 缓冲区错误漏洞
The H3C GR-1200W is a Gigabit enterprise wireless router from China's Xinhua San H3C. A security vulnerability exists in the H3C GR-1200W MiniGRW1A0V100R006 version that stems from a stack overflow in the UpdateWanLinkspyMulti method...
Security update for containerd (moderate)
openSUSE Security Update: Security update for containerd Announcement ID: openSUSE-SU-2021:2412-1 Rating: moderate References: 1188282 Cross-References: CVE-2021-32760 CVSS scores: CVE-2021-32760 SUSE: 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 An update...
Description of the security update for Office 2013: April 14, 2020
Description of the security update for Office 2013: April 14, 2020 Summary This security update resolves a remote code execution vulnerability that exists if Microsoft Office incorrectly loads arbitrary type libraries. To learn more about the vulnerability, see Microsoft Common Vulnerabilities an...
Servicing stack update for Windows 10, version 1903 and 1909: January 14, 2020
None None...
grub2 security update
2.02-78.0.2 - grub-set-bootflag: fix grubenv update method, fix CVE-2019-14865 Orabug: 30607067...
Servicing stack update for Windows 10, Version 1703: July 9, 2019
None None...
Description of the security update for Office Online Server: June 11, 2019
None None...
Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15866)
The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the "user update" method in versions of Quest DR Series disk backup software prior to version 4.0.3.1. An attacker could exploit this vulnerability to execute arbitrary system commands...
kernel: local privesc in key management
A flaw was found in the Linux kernel's key management system where it was possible for an attacker to escalate privileges or crash the machine. If a user key gets negatively instantiated, an error code is cached in the payload area. A negatively instantiated key may be then be positively...
Exponent CMS SQL Injection Vulnerability (CNVD-2016-10804)
Exponent is a web content management system. Multiple SQL injection vulnerabilities exist in the framework/modules/core/controllers/expRatingController.php/update method in Exponent CMS version 2.4.0, which can be exploited by an authenticated remote user to execute arbitrary SQL commands via the...
CVE-2016-9242
Multiple SQL injection vulnerabilities in the update method in framework/modules/core/controllers/expRatingController.php in Exponent CMS 2.4.0 allow remote authenticated users to execute arbitrary SQL commands via the 1 contenttype or 2 subtype parameter...
CVE-2012-2330
The Update method in src/nodehttpparser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information request header contents and possibly spoof HTTP headers via a zero length string...
CVE-2012-2330
The Update method in src/nodehttpparser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information request header contents and possibly spoof HTTP headers via a zero length string...
CVE-2012-2330
The CVE-2012-2330 entry affects Node.js, where the Update method in src/node_http_parser.cc fails to properly check string length in versions prior to 0.6.17 and 0.7 prior to 0.7.8. This could allow remote attackers to read sensitive request header contents and potentially spoof HTTP headers via ...
CVE-2012-2330
The Update method in src/nodehttpparser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information request header contents and possibly spoof HTTP headers via a zero length string...
CVE-2012-2330
The Update method in src/nodehttpparser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information request header contents and possibly spoof HTTP headers via a zero length string...
Node.js HTTP parsing vulnerability-vulnerability warning-the black bar safety net
Indicates a temporary no nodejs in the field, and nodejs in the country I'm in Ali cloud seen once, it is sent to it. the poc in this: https://gist.github.com/2628868 The official announcement on this: http://blog.nodejs.org/2012/05/07/http-server-security-vulnerability-please-upgrade-to-0-6-17/...