Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie header, allowing a malicious server to set cookies for unrelated domains. The cookie middleware is disabled by default, so most library consumers will not be affected by this issue. Only those who manually add the cookie middleware to the handler…
Ретро - это способ осознать какую работу проделала команда за время спринта. Благодаря Ретро всплывают вопросы и задачи, которые в ежедневной рутине откладываются на потом и игнорируются. В этой рассказано из чего состоит Ретро и приведены практиками, которые помогают разнообразить Ретро, получить больший результат. Читать
In ginadmin through 05-10-2022 the incoming path value is not filtered, resulting in directory traversal.
In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading.
Persistent Cross-Site Scripting (XSS) vulnerability in Vsourz Digital's Advanced Contact form 7 DB plugin <= 1.8.7 at WordPress.
Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the scanning the aemobile component can crash the scanning engine. The exploit can be triggered remotely by an attacker.
TrueStack Direct Connect 1.4.7 has Incorrect Access Control.
A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the state file does not exist, it is created with world-readable permission, allowing an unprivileged user to lock the state file, stopping any rotation. This flaw affects logrotate versions before 3.20.0.
Docker Desktop 4.3.0 has Incorrect Access Control.