964 matches found
CVE-2023-27266: Exposure of Sensitive Information to an Unauthorized Actor
Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response...
SUSE CVE-2021-33033
The Linux kernel before 5.11.14 has a use-after-free in cipsov4genopt in net/ipv4/cipsoipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value...
SUSE CVE-2021-45387
tcpreplay 4.3.4 has a Reachable Assertion in addtreeipv4 at tree.c...
CVE-2023-25576: Allocation of Resources Without Limits or Throttling
@fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experience denial of service due to a number of situations in which an unlimited number of parts are accepted. This includes the multipart body parser accepting an...
KASAGO IPv6/v4 Dual 安全特征问题漏洞
KASAGO IPv6/v4 Dual is KASAGO's protocol middleware for TCP/IP communication. A security vulnerability exists in KASAGO IPv6/v4 Dual that stems from an insufficiently randomized ISN Initial Sequence Number. An attacker can exploit this vulnerability to predict the value of the ISN...
Malicious Package
Overview bootstrap-v4 is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...
Weak password vulnerability in TOTOLINK N300RH V4
The TOTOLINK N300RH V4 is a wireless router. The TOTOLINK N300RH V4 suffers from a weak password vulnerability that can be exploited by attackers to obtain sensitive information...
GO-2022-1159 Path traversal in github.com/containers/podman/v4
The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality...
CVE-2022-45942
A Remote Code Execution RCE vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4...
Remote code execution
A Remote Code Execution RCE vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4...
PT-2022-27696 · Baijiacms · Baijiacms
Name of the Vulnerable Software and Affected Versions: baijiacms version v4 Description: A Remote Code Execution RCE vulnerability was found in includes/baijiacms/common.inc.php. Recommendations: For baijiacms version v4, consider restricting access to the includes/baijiacms/common.inc.php file...
CVE-2022-46139
Summary : CVE-2022-46139 affects TP-Link TL-WR940N V4, specifically versions 3.16.9 and earlier. The issue allows an authenticated attacker to trigger a Denial of Service by uploading a crafted firmware image during the firmware update process. What’s affected : The vulnerable device is the TP-Li...
CVE-2022-45942
A Remote Code Execution RCE vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4...
CVE-2022-46139: Insufficient Verification of Data Authenticity
TP-Link TL-WR940N V4 3.16.9 and earlier allows authenticated attackers to cause a Denial of Service DoS via uploading a crafted firmware image during the firmware update process...
CVE-2022-45942
A Remote Code Execution RCE vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4...
CVE-2020-36565 Directory traversal on Windows in github.com/labstack/echo/v4
Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...
Cross site request forgery (csrf)
perfSONAR v4.x = v4.4.5 was discovered to contain a Cross-Site Request Forgery CSRF which is triggered when an attacker injects crafted input into the Search function...
CVE-2022-41413
CVE-2022-41413 affects perfSONAR v4.x through v4.4.5, with a Cross-Site Request Forgery (CSRF) vulnerability triggered when crafted input is injected into the Search function. The issue is a partial blind CSRF that can cause the client to issue background requests to arbitrary URLs, bypassing the...