CVE-2022-34662 Apache DolphinScheduler prior to 3.0.0 allows path traversal

When users add resources to the resource center with a relation path will cause path traversal issues and only for logged-in users. You could upgrade to version 3.0.0 or higher...

CVE-2022-24868 Cross site scripting via SVG file upload in GLPI

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can exploit a lack of sanitization on SVG file uploads and inject javascript into their user avatar. As a result any user...

CVE-2022-24825 Smokescreen SSRF via deny list bypass

Smokescreen is a simple HTTP proxy that fogs over naughty URLs. The primary use case for Smokescreen is to prevent server-side request forgery SSRF attacks in which external attackers leverage the behavior of applications to connect to or scan internal infrastructure. Smokescreen also offers an...

Vulnerability in Citrix Broadcast Server could result in SQL injection

Description of Problem A vulnerability has been identified in the Web-based management interface of Citrix Broadcast Server, a component of the Citrix Application Gateway, that could result in arbitrary SQL query execution. This vulnerability affects the following products: • Citrix Application...

Improper Authorization in loopback

Vulnerable versions of loopback may allow attackers to create Authentication Tokens on behalf of other users due to Improper Authorization. If the AccessToken model is publicly exposed, an attacker can create Authorization Tokens for any user as long as they know the target's userId. This will...

Command Execution Vulnerability in AC15 Upgrade Software of Shenzhen Jixiang Tengda Technology Co.(CNVD-2020-40766)

The AC15 upgrade software is manufactured by Shenzhen Jixiang Tengda Technology Co., Ltd. and features a built-in dual-core processor with DDR3 memory. The Shenzhen Jixiang Tengda Technology Co., Ltd AC15 Upgrade Software suffers from a command execution vulnerability that can be exploited by...

Command Execution Vulnerability in AC15 Upgrade Software of Shenzhen Jixiang Tengda Technology Co.

The AC15 upgrade software is manufactured by Shenzhen Jixiang Tengda Technology Co., Ltd. and features a built-in dual-core processor with DDR3 memory. The Shenzhen Jixiang Tengda Technology Co., Ltd AC15 Upgrade Software suffers from a command execution vulnerability that can be exploited by...

Buffer Overflow Vulnerability in AC9V3.0 Upgrade Software of Shenzhen Jixiang Tengda Technology Co.

AC9V3.0 upgrade software is a Gigabit Ethernet port wireless router from Shenzhen Jixiang Tengda Technology Co. Ltd. AC9V3.0 upgrade software has a buffer overflow vulnerability, which can be exploited by an attacker to cause a denial of service overwrite the return value of a function, and the...

Buffer overflow vulnerability in AC9V3.0 upgrade software of Shenzhen Jixiang Tengda Technology Co.(CNVD-2020-29380)

AC9V3.0 upgrade software is a Gigabit Ethernet port wireless router from Shenzhen Jixiang Tengda Technology Co. Ltd. AC9V3.0 upgrade software has a buffer overflow vulnerability, which can be exploited by an attacker to cause a denial of service overwrite the return value of a function, and the...

Buffer overflow vulnerability in AC9V3.0 upgrade software of Shenzhen Jixiang Tengda Technology Co.(CNVD-2020-29379)

AC9V3.0 upgrade software is a Gigabit Ethernet port wireless router from Shenzhen Jixiang Tengda Technology Co. Ltd. AC9V3.0 upgrade software has a buffer overflow vulnerability, which can be exploited by an attacker to cause a denial of service overwrite the return value of a function, and the...

Buffer overflow vulnerability in AC9V3.0 upgrade software of Shenzhen Jixiang Tengda Technology Co.(CNVD-2020-29382)

AC9V3.0 upgrade software is a Gigabit Ethernet port wireless router from Shenzhen Jixiang Tengda Technology Co. Ltd. AC9V3.0 upgrade software has a buffer overflow vulnerability, which can be exploited by an attacker to cause a denial of service overwrite the return value of a function, and the...

Buffer overflow vulnerability in AC9V3.0 upgrade software of Shenzhen Jixiang Tengda Technology Co.(CNVD-2020-29378)

AC9V3.0 upgrade software is a wireless router with gigabit network port from Shenzhen Jixiang Tengda Technology Co. Ltd. AC9V3.0 upgrade software has a buffer overflow vulnerability, which can be exploited by an attacker to cause a denial of service overwrite the return value of a function, and t...

GHSA-XF27-JQWV-GF3R Unintended Require in larvitbase-api

Versions of larvitbase-api prior to 0.5.4 are vulnerable to an Unintended Require. The package exposes an API endpoint and passes a GET parameter unsanitized to an require call. This allows attackers to execute any .js file in the same folder as the server is running. Recommendation Upgrade to...

assign-deep Vulnerable to Prototype Pollution

Versions of assign-deep prior to 1.0.1 and 0.4.8 are vulnerable to Prototype Pollution. The assign function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects...

Security Bulletin: Potential cross-site scripting vulnerability with the Installation Verification Tool of IBM WebSphere Application Server may affect IBM InfoSphere Identity Insight (CVE-2018-1643)

Summary There is a potential cross-site scripting vulnerability with the Installation Verification Tool of IBM WebSphere Application Server shipped as part of IBM InfoSphere Identity Insight. Vulnerability Details CVEs: CVE-2018-1643 Link to security bulletin:...

Cross-site Scripting

XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafted URL. This...

Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames

Versions of samlify prior to 2.4.0-rc5 are vulnerable to Authentication Bypass. The package fails to prevent XML Signature Wrapping, allowing tokens to be reused with different usernames. A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic...

DSA-3454-1 virtualbox - security update

Bulletin has no description...

WordPress Simple Download Monitor Plugin <= 3.2.8 - Insufficient Authorisation

Because of this vulnerability, any user can access the "sdmtinygetpostids" action which will return a JSON encoded list of all "postid"and "posttitle" that were uploaded with this plugin. Solution Upgrade the plugin...

DSA-3291-1 drupal7 - security update

Bulletin has no description...