Rust 缓冲区错误漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A buffer overflow vulnerability exists in the Rust standard library prior to version 1.2.0, which stems from the binary heap being in a failure to agree state when comparing generic elements of sift up or...

CVE-2021-20327

A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and th...

PT-2021-13886 · Mongodb · Mongodb-Client-Encryption

Name of the Vulnerable Software and Affected Versions: mongodb-client-encryption module version 1.2.0 Description: The issue arises from the mongodb-client-encryption module's failure to correctly validate the KMS server's certificate. This could allow an attacker with a privileged network positi...

Rust yottadb Resource Management Error Vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A resource management error vulnerability exists in Rust yottadb. The vulnerability stems from an error in the memory allocation mode causing memory to remain available after it has been freed by the...

UBUNTU-CVE-2019-17582

A use-after-free in the zipdirentread function of zipdirent.c in libzip 1.2.0 allows attackers to have an unspecified impact by attempting to unzip a malformed ZIP archive. NOTE: the discoverer states "This use-after-free is triggered prior to the double free reported in CVE-2017-12858."...

Apache Guacamole <= 1.2.0 Information Disclosure Vulnerability

Apache Guacamole is prone to an information disclosure vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Apache DolphinScheduler 安全漏洞

Apache DolphinScheduler is a distributed decentralized , easily scalable visual DAG workflow task scheduling system . Committed to solving the intricate dependencies in the data processing process , so that the scheduling system in the data processing process out of the box . Apache...

Security Bulletin: A vulnerability have been identified in jwt-go shipped with IBM Netcool Operations Insight Event Integrations Operator (CVE-2020-26160)

Summary jwt-go is a dependency shipped with IBM Netcool Operations Insight Event Integrations Operator. Information about the security vulnerability affecting jwt-go has been published. CVE-2020-26160 Vulnerability Details CVEID: CVE-2020-26160 DESCRIPTION: jwt-go could allow a remote attacker to...

PT-2020-18891 · Valve · Game Networking Sockets

Name of the Vulnerable Software and Affected Versions: Valve's Game Networking Sockets versions prior to v1.2.0 Description: The issue arises from the improper handling of unreliable segments with negative offsets in the SNP ReceiveUnreliableSegment function, leading to a Heap-Based Buffer...

CVE-2020-26701

Cross-site scripting XSS vulnerability in Dashboards section in Kaa IoT Platform v1.2.0 allows remote attackers to inject malicious web scripts or HTML Injection payloads via the Description parameter...

Debian DLA-2445-1 : libmaxminddb security update

A heap-based buffer over-read has been found in libmaxminddb, an IP geolocation database library. This could be exploited when the mmdblookup tool is used to open a specially crafted database file. For Debian 9 stretch, this problem has been fixed in version 1.2.0-1+deb9u1. We recommend that you...

PT-2020-17001 · Readytalk · Readytalk Avian

Name of the Vulnerable Software and Affected Versions: ReadyTalk Avian versions 1.2.0 through 1.2.0 before 2020-10-27 Description: An issue was discovered in the FileOutputStream.write method in FileOutputStream.java, where an integer overflow leads to bypassing the boundary check and achieving...

XSS Vulnerability in Nonecms 1.2.0

NoneCms is an open source content management system. An XSS vulnerability exists in Nonecms 1.2.0, which can be exploited by attackers to obtain an administrator cookie...

CVE-2020-15181

The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security decision. Intruders can get admin's access to the system using the vulnerability in the project. Impacts all servers where this add-on is installed. The problem is fixed in version 1.2.0...

CVE-2020-15181

The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security decision. Intruders can get admin's access to the system using the vulnerability in the project. Impacts all servers where this add-on is installed. The problem is fixed in version 1.2.0...

Design/Logic Flaw

The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security decision. Intruders can get admin's access to the system using the vulnerability in the project. Impacts all servers where this add-on is installed. The problem is fixed in version 1.2.0...

CVE-2020-15181 Admin account takeover in Alfresco Reset Password

The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security decision. Intruders can get admin's access to the system using the vulnerability in the project. Impacts all servers where this add-on is installed. The problem is fixed in version 1.2.0...

PT-2020-16172 · Alfresco +1 · Alfresco Reset Password Add-On +1

Name of the Vulnerable Software and Affected Versions: Alfresco Reset Password add-on versions prior to 1.2.0 Description: The issue allows a malicious user to inject a query within the email input field, utilizing CMIS-SQL Injection. Recommendations: For versions prior to 1.2.0, update the Reset...

DBHcms Cross-Site Scripting Vulnerability (CNVD-2020-52191)

DBHcms is a small PHP open source content management system. It is suitable for personal and small business websites. DBHcms version 1.2.0 cross-site scripting vulnerability , the vulnerability stems from the lack of WEB applications on the client side of the correct validation of data , an...

Undefined Behavior in zencashjs

Versions of zencashjs prior to 1.2.0 may cause loss of funds when used with cryptocurrency wallets. The package relies on a string comparison of the first two characters of a Horizen address to determine the destination address type of a transaction P2PKH or P2SH. Due to the base58 address prefix...