Jenkins GitHub Branch Source Plugin vulnerable to Cross-Site Request Forgery

GitHub Branch Source Plugin connects to a user-specified GitHub API URL e.g. GitHub Enterprise as part of form validation and completion e.g. to verify Scan Credentials are correct. This functionality improperly checked permissions, allowing any user with Overall/Read access to Jenkins to connect...

Arbitrary file write in Apache Commons Fileupload

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance...

GHSA-QX6H-9567-5FQW Arbitrary file write in Apache Commons Fileupload

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance...

GHSA-CG5H-Q983-4RWW Apache Storm remote code execution vulnerability

The UI daemon in Apache Storm 0.10.0-beta allows remote users to run arbitrary code as the user running the web server. With kerberos authentication this could allow impersonation of arbitrary users on other systems, including HDFS and HBase...

GHSA-68QQ-3PHH-53J7 mod_cluster Denial of Service vulnerability

modcluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service Apache http server crash via an MCMP message containing a series of = equals characters after a legitimate element...

mod_cluster Denial of Service vulnerability

modcluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service Apache http server crash via an MCMP message containing a series of = equals characters after a legitimate element...

CVE-2022-25591

BlogEngine.NET v3.3.8.0 was discovered to contain an arbitrary file deletion vulnerability which allows attackers to delete files within the web server root directory via a crafted HTTP request...

CVE-2022-25591

BlogEngine.NET v3.3.8.0 was discovered to contain an arbitrary file deletion vulnerability which allows attackers to delete files within the web server root directory via a crafted HTTP request...

Arbitrary file deletion

BlogEngine.NET v3.3.8.0 was discovered to contain an arbitrary file deletion vulnerability which allows attackers to delete files within the web server root directory via a crafted HTTP request...

CVE-2022-25591

BlogEngine.NET v3.3.8.0 was discovered to contain an arbitrary file deletion vulnerability which allows attackers to delete files within the web server root directory via a crafted HTTP request...

GHSA-44P8-C3WV-F28R Directory Traversal in Studio 42 elFinder

Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process. NOTE: this issue...

Directory Traversal in Studio 42 elFinder

Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process. NOTE: this issue...

elFinder Path Traversal vulnerability

Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process...

GHSA-45X3-MW7Q-WF7F elFinder Path Traversal vulnerability

Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process...

TIBCO Security Advisory: May 18, 2022 - TIBCO BusinessConnect Trading Community Management-CVE-2022-22777

TIBCO BusinessConnect Trading Community Management Reflected Cross Site Scripting Vulnerability Original release date:May 18, 2022 Last revised: --- CVE-2022-22777 Source: TIBCO Software Inc. Products Affected TIBCO BusinessConnect Trading Community Management versions 6.1.0 and below The followi...

TIBCO Security Advisory: May 18, 2022 - TIBCO BusinessConnect Trading Community Management-CVE-2022-22777

TIBCO BusinessConnect Trading Community Management Reflected Cross Site Scripting Vulnerability Original release date:May 18, 2022 Last revised: --- CVE-2022-22777 Source: TIBCO Software Inc. Products Affected TIBCO BusinessConnect Trading Community Management versions 6.1.0 and below The followi...

TIBCO Security Advisory: May 18, 2022 - TIBCO BusinessConnect Trading Community Management-CVE-2022-22778

TIBCO BusinessConnect Trading Community Management Cross-Site Request Forgery Vulnerability Original release date: May18, 2022 Last revised: --- CVE-2022-22778 Source: TIBCO Software Inc. Products Affected TIBCO BusinessConnect Trading Community Management versions 6.1.0 and below The following...

TIBCO Security Advisory: May 18, 2022 - TIBCO BusinessConnect Trading Community Management-CVE-2022-22778

TIBCO BusinessConnect Trading Community Management Cross-Site Request Forgery Vulnerability Original release date: May18, 2022 Last revised: --- CVE-2022-22778 Source: TIBCO Software Inc. Products Affected TIBCO BusinessConnect Trading Community Management versions 6.1.0 and below The following...

Cambium Networks cnMaestro Operating System Command Injection Vulnerability

Cambium Networks cnMaestro is a cloud-based or native software platform from Cambium Networks for secure end-to-end network control. Cambium Networks cnMaestro suffers from an operating system command injection vulnerability. An attacker could exploit this vulnerability to access the cnMaestro...

B&R Automation Runtime 安全漏洞

B&R Automation Runtime is a major component of AS from B&R Automation, an Austrian company. A security vulnerability exists in B&R Automation Runtime versions prior to 4.91 that stems from improper buffer limits in the web server. Exploitation of the vulnerability by an unauthenticated attacker...