DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
genua genucenter: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2023-08-20
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in genua genucenter ausnutzen, um Informationen offenzulegen, Dateien zu manipulieren, um Cross-Site Scripting Angriffe durchzuführen oder um einen nicht näher spezifizierten Angriff durchzuführen.
01
beschreibt (18)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-28362US | — | — | ||
The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services whic… | ||||
| CVE-2023-27539US | medium5.3 | — | ||
There is a denial of service vulnerability in the header parsing component of Rack. | ||||
| CVE-2023-23913US | — | — | ||
There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. Th… | ||||
| CVE-2023-32001US | — | — | ||
Rejected reason: We issued this CVE pre-maturely, as we have subsequently realized that this issue points out a problem that there really is no safe measures around or protections… | ||||
| CVE-2023-29469US | medium6.5 | — | ||
An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, l… | ||||
| CVE-2023-28484US | medium6.5 | — | ||
In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xml… | ||||
| CVE-2023-27530US | high7.5 | — | ||
A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that c… | ||||
| CVE-2023-27320US | high7.2 | — | ||
Sudo before 1.9.13p2 has a double free in the per-command chroot feature. | ||||
| CVE-2023-23916US | medium6.5 | — | ||
An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can… | ||||
| CVE-2023-23915US | medium6.5OT erhöht | — | ||
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested i… | ||||
| CVE-2023-23914US | critical9.1OT erhöht | — | ||
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using it… | ||||
| CVE-2023-22799US | high7.5 | — | ||
A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpect… | ||||
| CVE-2023-22796US | high7.5 | — | ||
A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression en… | ||||
| CVE-2023-22795US | high7.5 | — | ||
A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause t… | ||||
| CVE-2023-22794US | high8.8 | — | ||
A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, th… | ||||
| CVE-2023-22792US | high7.5 | — | ||
A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOS… | ||||
| CVE-2022-44566US | high7.5 | — | ||
A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer is provided to the P… | ||||
| CVE-2021-28092US | high7.5 | — | ||
The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker provides a malicious… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan