8488 matches found
HashiCorp go-getter 输入验证错误漏洞
HashiCorp go-getter is a library for HashiCorp's Go golang for downloading files or directories from various sources using URLs as the primary form of input. An input validation error vulnerability exists in HashiCorp go-getter version 2.0.2 and prior versions, which stems from the inability to...
Magento stored cross-site scripting vulnerability in the customer address upload feature
Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by a stored cross-site scripting vulnerability in the customer address upload feature that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious...
Denial of Service (DoS)
Overview Microsoft.AspNetCore.App.Runtime.linux-musl-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Denial of Service DoS due to the way the Kestrel...
Denial of Service (DoS)
Overview Microsoft.AspNetCore.App.Runtime.win-x86 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Denial of Service DoS due to the way the Kestrel web...
Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window...
GHSA-VW57-55F8-C73Q Mattermost Server allows XSS via CSRF
An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF...
GHSA-PM48-CVV2-29Q5 Ansible Uses Plugins That Disclose Credentials
Ansible, all ansibleengine-2.x versions and ansibleengine-3.x up to ansibleengine-3.5, was logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed i...
CVE-2022-29309
mysiteforme v2.2.1 was discovered to contain a Server-Side Request Forgery...
CVE-2022-0346
The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thus causing XSS via error message or RCE if allowurlinclude is turned on...
UBUNTU-CVE-2022-29190
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infinite loop when processing. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available...
Rakuten Mobile Rakuten Casa 安全漏洞
Rakuten Mobile Rakuten Casa is a small base station from Rakuten Mobile Japan, Inc. It is used to improve radio wave conditions for users.An access control error vulnerability exists in Rakuten Mobile Rakuten Casa APFV200 version and APFV141 version, which stems from improper access restrictions....
CVE-2022-29445
Authenticated administrator or higher role Local File Inclusion LFI vulnerability in Wow-Company's Popup Box plugin = 2.1.2 at WordPress...
DEBIAN-CVE-2022-1795
Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV...
DEBIAN-CVE-2022-30067
GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the program will allocate for a huge amount of memory, resulting in insufficient memory or program crash...
GHSA-88F6-79X2-XQF3 Apache Jetspeed vulnerable to SQL Injection
Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the 1 role or 2 user parameter to services/usermanager/users/...
GHSA-W2XW-44R3-4V9G Connect-Multiparty allows arbitrary file upload
An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary code via a crafted PDF file. NOTE: the Supplier has not verified this vulnerability report...
Jenkins Mercurial Plugin 信息泄露漏洞
Jenkins and Jenkins Plugin are both open source Jenkins products. Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.An information disclosure vulnerability...
Connect-Multiparty 代码问题漏洞
Connect-Multiparty is a module. It is used for Connect-Multiparty middleware. A code issue vulnerability exists in Connect-Multiparty version 2.2.0, which stems from an arbitrary file upload issue in the File Upload module. An attacker can execute arbitrary code via a crafted PDF file...
GHSA-QF2H-H3XQ-J93J Jenkins allows Remote Users to Inject Build Parameters
Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables...