curl: credential leak on redirect

A vulnerability was found in curl. This security flaw allows leaking credentials to other servers when it follows redirects from auth-protected HTTPS URLs to other protocols and port numbers...

keycloak-services: ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader

ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available...

DEBIAN-CVE-2022-31108

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. An attacker is able to inject arbitrary CSS into the generated graph allowing them to change the styling of elements outside of the...

curl 资源管理错误漏洞

curl is a tool for transferring data from or to a server. A resource management error vulnerability exists in curl versions 7.71.0 through 7.83.1, which stems from curl's lack of a limit on the size of the Set-Cookie in generated HTTP requests. An attacker could exploit this vulnerability to...

The vulnerability of the Navigation Pages, Portal, and Query components of the Oracle PeopleSoft Enterprise PeopleTools business application allows a perpetrator to gain access to read data or modify data.

The vulnerability of the Navigation Pages, Portal, and Query components in Oracle PeopleSoft Enterprise PeopleTools exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to data or modify data using HTTP reques...

The vulnerability of the User Interface component of the Oracle Transportation Management software allows a perpetrator to gain access to read data or modify data.

The vulnerability of the User Interface component of the Oracle Transportation Management software is related to errors in the code. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to data or modify data using HTTP requests...

The vulnerability of the Web Services Security component of the Oracle Web Services Manager allows a perpetrator to gain read access to data or modify data.

The vulnerability of the Web Services Security component of the Oracle Web Services Manager exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain read access to data or modify data using specially crafted HTTP...

The vulnerability of the Visual Analyzer component of the Oracle Business Intelligence Enterprise Edition software platform allows a perpetrator to gain access to read data or modify data.

The vulnerability of the Visual Analyzer component of the Oracle Business Intelligence Enterprise Edition software relates to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to read data or modify data through HTTP...

CVE-2022-34206

A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTTP POST requests to an attacker-specified URL...

The vulnerability of the EAS Console component of the Oracle Hyperion Essbase Administration Services service allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the EAS Console component of the Oracle Hyperion Essbase Administration Services exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information through...

The vulnerability of the e-mail notification component of the PeopleSoft Enterprise HCM Candidate Gateway software allows a malicious individual to gain access to read, modify, add, or delete data.

The vulnerability of the email notification component of the PeopleSoft Enterprise HCM Candidate Gateway software lies in insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to gain access to read, modify, add, or delete data through HTTP requests...

The vulnerability of the web interface for managing microprogrammed software routers of Cisco Small Business RV110W, RV130, RV130W, and RV215W lies in insufficient validation of input data. This allows an attacker to execute arbitrary code or trigger a service failure by sending specially crafted HTTP packets.

The vulnerability of the web interface for managing microprogrammed software routers of Cisco Small Business RV110W, RV130, RV130W, and RV215W is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code or cause a service...

SUSE SLES15 Security Update : rubygem-actionpack-5_1, rubygem-activesupport-5_1 (SUSE-SU-2022:2108-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2108-1 advisory. - The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the...

CVE-2022-20825

A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly, resulting in a denial of service DoS condition. Th...

The vulnerability of the Siebel Core – Server Infrastructure component of the Oracle Siebel CRM system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Siebel Core – Server Infrastructure component of the Oracle Siebel CRM system exists due to insufficient verification of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through...

CVE-2022-32559

An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests lead to leaked metrics...

CVE-2022-30937

A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant All versions, EN100 Ethernet module IEC 104 variant All versions, EN100 Ethernet module IEC 61850 variant All versions V4.37, EN100 Ethernet module Modbus TCP variant All versions, EN100 Ethernet module PROFINET IO varia...

PT-2022-21371 · Couchbase · Couchbase Server

Name of the Vulnerable Software and Affected Versions: Couchbase Server versions prior to 7.0.4 Description: An issue was discovered in Couchbase Server where random HTTP requests can lead to leaked metrics. Recommendations: For versions prior to 7.0.4, update to version 7.0.4 or later to resolve...

The vulnerability of the AME Page rendering component of the Oracle Approvals Management component within the Oracle E-Business Suite system, which allows a perpetrator to gain access to read, modify, add, or delete data.

The vulnerability in the AME Page rendering of the Oracle Approvals Management component of the Oracle E-Business Suite exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to gain access to read, modify, add, or delete data through HTTP...

The vulnerability of the Change Management sub-component of the Oracle Engineering component in the Oracle E-Business Suite allows a malicious actor to gain access to read, modify, add, or delete data.

The vulnerability of the Change Management sub-component of the Oracle Engineering component in the Oracle E-Business Suite exists due to insufficient verification of input data. Exploiting this vulnerability allows a malicious actor to gain access to read, modify, add, or delete data through HTT...