In Afian Filerun 20220202, lack of sanitization of the POST parameter "metadata[]" in `/?module=fileman§ion=get&page=grid` leads to SQL injection.
Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to information disclosure.
Due to improper error handling an authenticated user can crash CLA assistant instance. This could impact the availability of the application.
Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send. These vulnerabilities allow attackers to execute Server-Side Request Forgery (SSRF) via a crafted TCP payload.
BI Launchpad and CMC in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Exploit is possible only when the bttoken in victim’s session is active.
Всем привет! Меня зовут Игорь, я работаю системным архитектором в CSI. Хочу поделиться историей появления в нашем стеке технологий надежного и универсального брокера сообщений. Расскажу, как и для чего мы его используем, поделюсь полезными нюансами и примером с сетью Fix Price. Статей про Apache Kafka уже более, чем достаточно, но наш кейс немного отличается от стандартного использования. Надеюсь, опыт пригодится кому-то ещё. Читать далее
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI.
IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php acl_id XSS.
Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution.