66 matches found
SATO America CL4NX License Issue Vulnerability
The SATO America CL4NX is a printer from SATO America. An authorization issue vulnerability exists in SATO America CL4NX version 1.13.2-u455r2, which stems from the presence of an improper authentication vulnerability...
PT-2023-32046 · Sato · Sato Cl4Nx-J Plus
Name of the Vulnerable Software and Affected Versions: SATO CL4NX-J Plus version 1.13.2-u455 r2 Description: A vulnerability was found in the SATO CL4NX-J Plus, affecting some unknown functionality of the file /rest/dir/. The manipulation of the full argument leads to path traversal. The attack...
Security Bulletin: Vulnerability in Spring Security affects IBM Process Mining . CVE-2023-20862
Summary There is a vulnerability in Spring Security that could allow a remote attacker to bypass security restrictions and remain authenticated after logout is performed. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability...
CVE-2023-30851
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple toEndpoints AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be...
Vault Enterprise Vulnerable to Padding Oracle Attacks When Using a CBC-Based Encryption Mechanism with a HSM
Summary A vulnerability was identified for specific Vault Enterprise “Vault” HSM integration configurations in which a padding oracle attack may be possible, due to Vault not properly applying an HMAC to messages sent from the HSM when using a CBC-based encryption mechanism. An attacker with...
Security Bulletin: Vulnerability in bpmn affects IBM Process Mining . WS-2019-0148
Summary There is a vulnerability in bpmn that could allow a remote attacker to execute a malicious script due to XSS. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details IBM X-Force ID: 221056 DESCRIPTION...
Security Bulletin: Vulnerability in Jettison affects IBM Process Mining . Multiple CVEs
Summary There is a vulnerability in Jettison that could allow an attacker to execute a DOS on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2022-40150 DESCRIPTION: jettison-jso...
Async 注入漏洞
Async is a utility module from Caolan McMahon Personal Developer in the UK. It is used to work with asynchronous JavaScript. A security vulnerability exists in Async HTTP Client version 1.13.2 and earlier versions. An attacker exploiting this vulnerability could open source a new HTTP header fiel...
Fedora 35 : js-jquery-ui (2022-22d8ba36d0)
The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-22d8ba36d0 advisory. A flaw was found in the jquery-UI package. Affected versions of this package are vulnerable to Cross-site scripting XSS attack via the initializatio...
CVE-2022-39379 Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution RCE vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads...
DEBIAN-CVE-2022-31160
jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents...
UBUNTU-CVE-2022-31160
jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents...
jQuery 跨站脚本漏洞
jQuery is the United States John Resig individual developers of a set of open source , cross-browser JavaScript library . The library simplifies the operation between HTML and JavaScript, and features modularity, plug-in extensions, and so on. A cross-site scripting vulnerability exists in jQuery...
CVE-2022-31160 jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label
jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents...
Uncaught Exception
Overview std/crypto/dsa is a Go standard library package std/crypto/dsa Affected versions of this package are vulnerable to Uncaught Exception. Go Vulnerability Report: via the dsa.Verify function. An attacker can cause a panic and potentially crash the application by submitting a crafted DSA...
Use After Free
Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Use After Free via the ID and IDREF attributes, when using the xmlReader interface with validation or when a document is parsed with XMLPARSEDTDVALID and without XMLPARSENOENT...
CVE-2021-38331
The WP-T-Wap WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the posted parameter found in the /wap/writer.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.13.2...
Command Injection in async-git
The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters back-ticks. For example: git.reset'atouch HACKEDb'...