SaltStack Salt 操作系统命令注入漏洞

Saltstack SaltStack Salt is a set of open source tools for managing infrastructure from SaltStack Saltstack. The tool provides configuration management, remote execution, and other features. A security vulnerability exists in SaltStack Salt versions 2016.9 through 3002.6, which stems from a comma...

CVE-2021-20546

IBM Spectrum Protect Client 8.1.0.0 through 8.1.11.0 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local attacker could overflow a buffer and cause the application to crash. IBM X-Force ID: 198934...

Vaadin flow 安全漏洞

Vaadin flow is a software application, a Java framework for the Vaadin platform, for building modern websites that look good, perform well, and keep you and your users happy. A security vulnerability exists in Vaadin flow that allows an attacker to guess a security token via a timing attack. The...

CVE-2021-2239

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite component: Timecard. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and...

GHSA-9W8R-397F-PRFH Infinite Loop in Pygments

An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML SML source file, as demonstrated by input that only contains the "exception" keyword...

Oracle E-Business Suite 安全漏洞

Oracle E-Business Suite is an extension of the original Application ERP, including ERP Enterprise Resource Planning, HR Human Resource Management, CRM Customer Relationship Management, and so on, a collection of management software, is a seamless integration of a management suite.Oracle Depot...

@ampproject/toolbox-update-cache (>=2.7.1-alpha.0, <=2.8.0), @apolitical/apis-client (>=1.0.0, <=1.1.5) +13 more potentially affected by CVE-2021-30246 via jsrsasign (>=10.0.0, <=10.1.13)

jsrsasign NPM version =10.0.0, =2.7.1-alpha.0, =1.0.0, =1.0.0, =0.2.0, =0.0.11, =9.21.5, =20.12.0, =1.0.11, =0.1.1, =0.1.10, =0.2.0, =0.3.0 Source cves: CVE-2021-30246 Source advisory: OSV:GHSA-27FJ-MC8W-J9WG...

Hashicorp HashiCorp Consul 安全漏洞

Hashicorp HashiCorp Consul is a suite of distributed, highly available data center-aware solutions from HashiCorp Hashicorp USA. The product is used to connect and configure applications across dynamically distributed infrastructures. A security vulnerability exists in Consul that could allow a...

Joomla! local file inclusion vulnerability (CNVD-2021-30597)

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A local file inclusion vulnerability exists in Joomla! versions 3.0.0 through...

Juniper Junos OS Vulnerability (JSA11154)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA11154 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. C Tenable Network Security, Inc...

SiCKRAGE Cross-Site Scripting Vulnerability

SickRage is an automated video library manager for TV programs. A reflected cross-site scripting vulnerability exists in SiCKRAGE versions 9.3.54.dev1 - 10.0.11.dev1. The vulnerability stems from the quicksearch feature not properly validating user input. An attacker can use this vulnerability to...

PYSEC-2021-147

in SiCKRAGE, versions 4.2.0 to 10.0.11.dev1 are vulnerable to Stored Cross-Site-Scripting XSS due to user input not being validated properly when processed by the server. Therefore, an attacker can inject arbitrary JavaScript code inside the application, and possibly steal a user’s sensitive...

UBUNTU-CVE-2022-24070

Subversion's moddavsvn is vulnerable to memory corruption. While looking up path-based authorization rules, moddavsvn servers may attempt to use memory which has already been freed. Affected Subversion moddavsvn servers 1.10.0 through 1.14.1 inclusive. Servers that do not use moddavsvn are not...

PT-2021-16856 · Sickrage · Sickrage

Name of the Vulnerable Software and Affected Versions: SiCKRAGE versions 9.3.54.dev1 to 10.0.11.dev1 Description: The issue arises from improper validation of user input in the quicksearch feature, leading to Reflected Cross-Site-Scripting XSS. This allows an attacker to steal a user's sessionID,...

Echel0n SiCKRAGE 跨站脚本漏洞

SickRage is an automated video library manager for TV programs. A stored cross-site scripting vulnerability exists in SiCKRAGE version 4.2.0 - 10.0.11.dev1. The vulnerability stems from the server processing user input without properly validating user input. An attacker can exploit the...

Eclipse Mosquitto 代码问题漏洞

Eclipse Mosquitto is an open source EPL/EDL licensed messaging agent that implements the MQTT protocol version 3.1 and 3.1.1. A null pointer dereference vulnerability exists in Eclipse Mosquitto versions 2.0.0 through 2.0.9. The vulnerability can be exploited to cause a null pointer dereference b...

CVE-2021-25894

Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting XSS vulnerability in the /magnoliaPublic/travel/members/login.html mgnlUserId parameter...

PT-2021-18202

Name of the Vulnerable Software and Affected Versions: pikepdf versions 1.3.0 through 2.9.2 Description: The issue allows XXE XML External Entity attacks when parsing XMP metadata entries in the models/metadata.py file of the pikepdf package for Python. This occurs due to improper handling of XML...

An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file as demonstrated by input that only contains the "exception" keyword.

...

ALPINE-CVE-2021-20270

An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML SML source file, as demonstrated by input that only contains the "exception" keyword...