8517 matches found
CVE-2022-31836
The leafInfo.match function in Beego v2.0.3 and below uses path.join to deal with wildcardvalues which can lead to cross directory risk...
HackerOne Employee Caught Stealing Vulnerability Reports for Personal Gains
Vulnerability coordination and bug bounty platform HackerOne on Friday disclosed that a former employee at the firm improperly accessed security reports submitted to it for personal gain. "The person anonymously disclosed this vulnerability information outside the HackerOne platform with the goal...
CVE-2022-32284
Use of insufficiently random values vulnerability exists in Vnet/IP communication module VI461 of YOKOGAWA Wide Area Communication Router WAC Router AW810D, which may allow a remote attacker to cause denial-of-service DoS condition by sending a specially crafted packet...
Design/Logic Flaw
Use of insufficiently random values vulnerability exists in Vnet/IP communication module VI461 of YOKOGAWA Wide Area Communication Router WAC Router AW810D, which may allow a remote attacker to cause denial-of-service DoS condition by sending a specially crafted packet...
CVE-2022-32284: Use of Insufficiently Random Values
Use of insufficiently random values vulnerability exists in Vnet/IP communication module VI461 of YOKOGAWA Wide Area Communication Router WAC Router AW810D, which may allow a remote attacker to cause denial-of-service DoS condition by sending a specially crafted packet...
WordPress plugin Import any XML or CSV File 代码问题漏洞
WordPress is a blogging platform developed using the PHP language. WordPress Import any XML or CSV File plugin versions prior to 3.6.8 are vulnerable to arbitrary file uploads, which originate from accepting all zip files and automatically extracting the zip file without validating the extracted...
GHSA-QM37-C4W6-H9V9 Missing Authorization in Jenkins XPath Configuration Viewer Plugin
XPath Configuration Viewer Plugin 1.1.1 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to access the XPath Configuration Viewer page. Given appropriate XPath expressions, this page grants access to job configuration XML data...
Yokogawa Wide Area Communication Router
1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION: Exploitable remotely Vendor: Yokogawa Equipment: Wide Area Communication Router WAC Router Vulnerability: Use of Insufficiently Random Values 2. RISK EVALUATION Successful exploitation of this vulnerability could cause the functions provided by the WAC...
PT-2022-31655
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 5.15.46 Description A potential security issue exists where the md/bitmap does not set sb values if it cannot pass a sanity check. The actual impact and attack plausibility have not yet been proven. Recommendatio...
PT-2022-32039
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 5.4.198 Description A potential security issue exists where the md/bitmap does not set sb values if it cannot pass a sanity check. The actual impact and attack plausibility have not yet been proven. Recommendatio...
CVE-2022-31104
Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal for WebAssembly on x8664 contained two distinct bugs in the instruction lowerings implemented in Cranelift. The aarch64 implementation of the simd proposal is not affected. The bu...
CVE-2022-31034
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or UI. The vulnerabilities are due to the use of insufficiently random values in...
CVE-2022-31034: Use of Insufficiently Random Values
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or UI. The vulnerabilities are due to the use of insufficiently random values in...
Yieldy._storeRebase() saves and emits wrong values.
Lines of code Vulnerability details Impact Yieldy.storeRebase saves and emits wrong values. I don't think the asset will be lost directly because of this but the rebase storage will have wrong values and it might affect the system later. Proof of Concept The previousCirculating must be a previous...
Information Disclosure
vdsm is vulnerable to information disclosure. The vulnerability exists due to a race condition allowing sensitive values in log files to be stored in clear text...
GHSA-MHP7-3393-PFQR Cross-site Scripting vulnerability in Jenkins
Since Jenkins 2.340, symbol-based icons unescape previously escaped values of tooltip parameters. This vulnerability is known to be exploitable by attackers with Job/Configure permission. Jenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability. Symbol-based icons no longer unescap...
CVE-2022-34172
In Jenkins 2.340 through 2.355 both inclusive symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting XSS vulnerability...
Malicious Package
Overview react-ldclient-default-values is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...
Malicious Package
Overview epic-fortnite-shared-values is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if th...