CVE-2023-20860

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass...

CVE-2023-20860

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass...

Spring Framework 安全漏洞

Spring Framework is the U.S. Spring team of a set of open source Java, JavaEE application framework. The framework helps developers build high-quality applications . A security vulnerability exists in Spring Framework versions 6.0.0 through 6.0.6 and 5.3.0 through 5.3.25, which stems from a schem...

PT-2023-14735 · Ezeip · Ezeip

Name of the Vulnerable Software and Affected Versions: ezEIP version 5.3.00649 Description: The issue is related to a cross-site scripting XSS vulnerability. Cross-site scripting is a type of security vulnerability that occurs when an attacker is able to inject malicious scripts into a website,...

PT-2022-27475 · Apache · Apache Shardingsphere-Proxy

Name of the Vulnerable Software and Affected Versions: Apache ShardingSphere-Proxy versions prior to 5.3.0 Description: The issue arises when Apache ShardingSphere-Proxy is used with MySQL as the database backend. In versions prior to 5.3.0, the database session is not properly cleaned up after a...

CVE-2022-2472

Improper Initialization vulnerability in the local server component of EZVIZ CS-C6N-A0-1C2WFR allows a local attacker to read the contents of the memory space containing the encrypted admin password. This issue affects: EZVIZ CS-C6N-A0-1C2WFR versions prior to 5.3.0 build 220428...

Input validation

Improper Initialization vulnerability in the local server component of EZVIZ CS-C6N-A0-1C2WFR allows a local attacker to read the contents of the memory space containing the encrypted admin password. This issue affects: EZVIZ CS-C6N-A0-1C2WFR versions prior to 5.3.0 build 220428...

EZVIZ 安全漏洞

EZVIZ CS-C6N-A0-1C2WFR and others are products of China Fluorite EZVIZ company.EZVIZ CS-C6N-A0-1C2WFR is a security camera.EZVIZ CS-CV248 is a security camera.EZVIZ CS-DB1C-A0-1E2W2FR is a powerful visual doorbell. A security vulnerability exists in versions prior to EZVIZ CS-C6N-A0-1C2WFR 5.3.0...

UBUNTU-CVE-2022-38153

An issue was discovered in wolfSSL before 5.5.0 when --enable-session-ticket is used; however, only version 5.3.0 is exploitable. Man-in-the-middle attackers or a malicious server can crash TLS 1.2 clients during a handshake. If an attacker injects a large ticket more than 256 bytes into a...

PT-2022-24245 · Wolfssl · Wolfssl

Name of the Vulnerable Software and Affected Versions: wolfSSL version 5.3.0 Description: An issue in wolfSSL allows man-in-the-middle attackers or a malicious server to crash TLS 1.2 clients during a handshake. This occurs when an attacker injects a large ticket more than 256 bytes into a...

Security Bulletin: IBM Sterling B2B Integrator is affected by a remote code execution in Spring Framework (CVE-2022-22965)

Summary IBM Sterling B2B Integrator is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22965 as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR in contrast to a Spri...

CVE-2022-31011 TiDB authentication bypass vulnerability

TiDB is an open-source NewSQL database that supports Hybrid Transactional and Analytical Processing HTAP workloads. Under certain conditions, an attacker can construct malicious authentication requests to bypass the authentication process, resulting in privilege escalation or unauthorized access...

PingCAP TiDB 授权问题漏洞

PingCAP TiDB is an open source, cloud-native, distributed, MySQL-compatible database for elastic scaling and real-time analytics from China-based PingCAP. PingCAP TiDB version 5.3.0 suffers from an authorization issue vulnerability, which stems from a problem with application rights management. A...

Pivotal Spring Framework contains unsafe Java deserialization methods

Pivotal Spring Framework before 6.0.0 suffers from a potential remote code execution RCE issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. Maintainers recommend...

WordPress Content Egg plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Content Egg plugin versions prior to 5.3.0 have a cross-site scripting vulnerability that stems fro...

GHSA-G5MM-VMX4-3RG7 Improper handling of case sensitivity in Spring Framework

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the fiel...

Default credentials

Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Since the rework of the Remember me cookie in version 5.3.0, the cookie is not invalidated when the user changes their password. Attackers can therefor...

PT-2021-23229 · Symfony · Symfony/Securitybundle

Name of the Vulnerable Software and Affected Versions: Symfony/SecurityBundle versions 5.3.0 through 5.3.11 Description: The issue arises from the rework of the Remember me cookie in Symfony version 5.3.0, where the cookie is not invalidated when a user changes their password. This allows attacke...

Zoom Client < 5.3.0 RCE Vulnerability (ZSB-21003) - Windows

Zoom Client is prone to a remote code execution RCE vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

CVE-2021-34411

During the installation process forZoom Rooms for Conference Room for Windows before version 5.3.0 it is possible to launch Internet Explorer with elevated privileges. If the installer was launched with elevated privileges such as by SCCM this can result in a local privilege escalation...