Schwachstellen, die jetzt zählen.

GeoNetwork is a catalog application to manage spatially referenced resources.

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately neutralizing it for template evaluation. A remote attacker can induce a victim, including an administrator, to open a crafted link so the reflected value is evaluated as an AngularJS…

mongo-c-driver: mongo-c-driver: Denial of Service via malformed query response

rust-mongodb: rust-mongodb: Information disclosure via diagnostic tracing

Monitoring Plugins is a suite of plugins for monitoring applications.

Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations…

Elo is a purely functional expression language for no-code tools.

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.ts accepts constructor as an ordinary identifier. The resulting generated…

Elo is a purely functional expression language for no-code tools.

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping #, so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint branch become executable Ruby. The affected entry points include the /try playground with the Ruby target, bin/eloc -t ruby -x, and defaultFormats.elo.parse() followed by Ruby…

Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to…

Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client's TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes.

elo: Elo: arbitrary code execution via unvalidated programmatic AST input

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. The affected fields are int_literal / float_literal .value, variable.name, member_access.property, object_literal keys, datapath segments, lambda.params[].name, and the…

A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and…

A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted…

An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted filename to the /sync…

Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to corrupt memory by sending an…

Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to corrupt memory by sending an overlong kill reason. Attackers controlling a rogue or compromised peer server can send a reason exceeding KILLLEN that overflows a static 512-byte buffer, crashing the ircd or potentially achieving remote code execution.

Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong…

Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in ms_join and ms_sjoin to crash the ircd or potentially achieve remote code execution.

phpmyadmin/motranslator: phpMyAdmin MoTranslator: Path traversal via manipulated locale argument

phpmyadmin/sql-parser: phpMyAdmin SQL-Parser: Denial of Service via improper type conversion

elasticsearch: elasticsearch: Denial of Service via deeply nested serialized payloads

phpmyadmin/shapefile: phpMyAdmin ShapeFile: Denial of Service via infinite loop in ShapeRecord::loadFromFile

github.com/mongodb/mongo-tools: MongoDB Database Tools: Unauthorized collection overwrite via improper URL decoding

github.com/mongodb/mongo-tools: mongofiles: Arbitrary file creation via parent-directory symlinks

mongo-tools: mongo-tools: information disclosure via database-stored filename manipulation in mongofiles

github.com/mongodb/mongo-tools: mongorestore: Privilege escalation via crafted collection names in database dumps

hdf5: hdf5: Denial of Service via NULL pointer dereference

slurm: Slurm: Arbitrary code execution via SQL injection in SlurmDBD RPCs

hdf5: hdf5: Denial of Service via heap buffer over-read in external link traversal

HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen() without validating the buffer against its stored size (udata_size, which was marked unused). A crafted HDF5 file containing an external link whose data is not NULL-terminated, or is too short to hold both strings…

slurm: slurm: Information disclosure via arbitrary memory read in slurmstepd socket API

hdf5: hdf5: Denial of Service via heap buffer over-read

Django: Mehrere Schwachstellen

django: Server-side request forgery via `SpatialReference` string input

Django: Mehrere Schwachstellen

django: Password hash disclosure to "view only" admin users with custom user models

Django: Mehrere Schwachstellen

django: Server-side request forgery via crs member of GeoJSON geometries

Django: Mehrere Schwachstellen

django: Potential log injection via unescaped geometry form values