122706 matches found
CVE-2026-73334
Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps encrypts data keys via a Key Management Service KMS. On the reader side, the...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
EUVD-2026-74804
Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps encrypts data keys via a Key Management Service KMS. On the reader side, the...
CVE-2026-73334
The org.apache.parquet.crypto.keytools package in Apache Parquet (versions 1.12 to 1.18) is vulnerable to a Server-side Request Forgery (SSRF) due to a host validation bypass. When the KMS URL is file-controlled rather than application-controlled, the FileKeyUnwrapper forwards the URL to a plugga...
CVE-2026-73334 Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation
Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps encrypts data keys via a Key Management Service KMS. On the reader side, the...
CVE-2026-73334 Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation
Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps encrypts data keys via a Key Management Service KMS. On the reader side, the...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through FileKeyUnwrapper in parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/FileKeyUnwrapper.java. An attacker can make a reader send its KMS access token to an attacker-controlled host b...
CVE-2026-54048 Apache Impala: Avro Schema URL Server-Side Request Forgery
Specifying tblproperties'avro.schema.url'=' http://...' or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error...
CVE-2026-54048 Apache Impala: Avro Schema URL Server-Side Request Forgery
Specifying tblproperties'avro.schema.url'=' http://...' or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error...
CVE-2026-54048 Apache Impala: Avro Schema URL Server-Side Request Forgery
Specifying tblproperties'avro.schema.url'=' http://...' or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error...
CVE-2026-78377
URL redirection to untrusted site 'open redirect' vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Phishing. This issue affects Library Information and Document Automation...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
EUVD-2026-74783
URL redirection to untrusted site 'open redirect' vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Phishing. This issue affects Library Information and Document Automation...
CVE-2026-78377 Open Redirect in Yordam Informatics's Library Automation System
URL redirection to untrusted site 'open redirect' vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Phishing. This issue affects Library Information and Document Automation...
CVE-2026-78377
CVE-2026-78377 is an Open Redirect vulnerability in the Library Information and Document Automation Program by Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. The flaw allows URL redirection to an untrusted site, enabling phishing attacks. The af...
CVE-2026-78377 Open Redirect in Yordam Informatics's Library Automation System
URL redirection to untrusted site 'open redirect' vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Phishing. This issue affects Library Information and Document Automation...
Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.
Summary Multiple vulnerabilities were addressed in IBM Sterling Partner Engagement Manager. Vulnerability Details CVEID:CVE-2021-23369 DESCRIPTION: The package handlebars before 4.7.7 are vulnerable to Remote Code Execution RCE when selecting certain compiling options to compile templates coming...
CVE-2026-87567
A flaw was found in Google Chrome. This user interface UI misrepresentation in URL formatting allows a remote attacker to leverage social engineering techniques. By using a specially crafted domain name, the attacker can spoof the address bar, potentially deceiving users about the authenticity of...
Malicious code in bx-ui-view (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce3874d2c55544bbbf59b6a60c3002b13e242fb53160a455597b13fdd37231f8 package.json declares a dependency whose key equals the package's own name bx-ui-view and whose value is a plain HTTPS URL...
MAL-2026-16064 Malicious code in bx-ui-view (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce3874d2c55544bbbf59b6a60c3002b13e242fb53160a455597b13fdd37231f8 package.json declares a dependency whose key equals the package's own name bx-ui-view and whose value is a plain HTTPS URL...