FasterXML jackson-databind 代码问题漏洞

FasterXML jackson-databind is a generic data binding package for Jackson 2.x. A security vulnerability exists in FasterXML jackson-databind. No details of the vulnerability are provided at this time...

Siemens Mendix Cross-Site Scripting Vulnerability

Siemens Mendix is a low-code application development platform from Siemens. The platform provides application development, testing, deployment and iteration capabilities. A cross-site scripting vulnerability exists in Mendix SSO version 2.1.1 and prior versions, which stems from improper HTML...

Win911 Mobile Server Security Vulnerability

Win911 Mobile Server is a server-side program used in industrial environments to provide interactive data support for mobile apps from Win911 USA. A security vulnerability exists in Win911 Mobile Server V2.5, which can be exploited by an attacker to overwrite the service executable and execute...

GNU C Library Buffer Error Vulnerability

The GNU C Library glibc, libc6 is an open-source, free C language compiler released under the LGPL license. A buffer error vulnerability exists in the GNU C Library through 2.32, which arises from incorrect handling of an invalid EUC-KR encoded multi-byte input sequence...

Linbit csync2 Input Validation Error Vulnerability

Linbit csync2 is a cluster synchronization tool from Austrian company Linbit, which is mainly used to keep files on multiple hosts in a cluster synchronized. A security vulnerability exists in LINBIT csync2 version 2.0 and earlier versions, which stems from a failure to properly check the return...

PT-2021-3164

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.x before 2.9.10.8 FasterXML jackson-databind versions 2.6.x before 2.6.7.5 Description The issue is related to the interaction between serialization gadgets and typing, specifically with the...

Vidyo Clickjacking Vulnerability

Vidyo is a software used to support video conferencing from Vidyo, Inc. in the United States. A clickjacking vulnerability exists in Vidyo version 02-09-/D. The vulnerability stems from the absence of protection such as X-Frame-Options, which could be exploited by an attacker to achieve...

Linbit csync2 输入验证错误漏洞

Linbit csync2 is a cluster synchronization tool from Austrian company Linbit, which is mainly used to keep files on multiple hosts in a cluster synchronized. A security vulnerability exists in LINBIT csync2 version 2.0 and earlier versions, which stems from a failure to properly check the return...

Certain NETGEAR devices Cross-Site Scripting Vulnerability

Netgear NETGEAR R8900 and others are products of Netgear, Inc.NETGEAR R8900 is a wireless router.NETGEAR R9000 is a wireless router.NETGEAR XR500 is a wireless router. A cross-site scripting vulnerability exists in Certain NETGEAR devices and the following products and versions are affected: D780...

CVE-2020-26290

Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library...

vulhub_v2

It is an offensive tool for web application security training. The repository contains a collection of vulnerable Docker environments for web application security training. The tool is designed to be easy to use, requiring only two simple commands to set up a vulnerable environment. The tool is n...

The vulnerability affects the implementation of HTTP/2 technology in browsers like Firefox, Firefox ESR, and the email client Thunderbird. This allows attackers to induce a service failure.

The vulnerability in the implementation of HTTP/2 technology in Firefox browsers, Firefox ESR, and the Thunderbird email client is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Http-rs Async-h1 Environment Issue Vulnerability

Http-rs Async-h1 is a Rust-based asynchronous Http parser from the Http-rs team. A security vulnerability exists in async-h1 versions prior to 2.3.0, which stems from the presence of a request smuggling vulnerability. This vulnerability affects any web server that uses async-h1 behind a reverse...

IBM Planning Analytics Cross-Site Request Forgery Vulnerability (CNVD-2020-74626)

IBM Planning Analytics is a planning, budgeting, forecasting and analytics solution. A cross-site request forgery vulnerability exists in IBM Planning Analytics 2.0. An attacker could exploit this vulnerability to perform malicious and unauthorized actions transmitted from a user trusted by the...

VulnCheck KEV: CVE-2020-36719

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lpccaddonsactions function. This makes it possible for unauthenticated...

CVE-2020-28217

A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 firmware 2.7 and older, that would allow an attacker to read network traffic over HTTP protocol...

PYSEC-2020-300

In TensorFlow release candidate versions 2.4.0rc, the general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of the array holding the directories. There are multiple invariants and preconditions that are assumed by the parallel...

PYSEC-2020-335

In TensorFlow release candidate versions 2.4.0rc, the general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of the array holding the directories. There are multiple invariants and preconditions that are assumed by the parallel...

Schneider Electric Easergy T300 安全漏洞

Easergy T300 is a new generation of intelligent terminals for distribution network automation, adhering to the design concepts of "modularity, flexibility, and application orientation", which can be widely used in medium-voltage distribution network management, fault location, isolation, and...

Vulnerability fixed in MISP

CIRCL has fixed a vulnerability in MISP. The vulnerability is located in the handling of templates and allows a malicious party to be able to launch a Cross-Site-Scripting attack XSS and thereby potentially execute arbitrary code in the context of the browser. CIRCL has released updates to fix th...