Średnia
CVE-2013-6044
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 6 861
Wyczyść filtry
Wysoka
CVE-2017-16762
Sanic before 0.5.1 allows reading arbitrary files with directory traversal, as demonstrated by the /static/..%2f substring.
Krytyczna
CVE-2017-16613
An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. The Swift object store and proxy server are saving (unhashed) tokens retrieved
Wysoka
CVE-2017-17054
In aubio 0.4.6, a divide-by-zero error exists in the function new_aubio_source_wavread() in source_wavread.c, which may lead to DoS when playing a crafted audio file.
Niska
CVE-2014-0105
The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authent
Krytyczna
CVE-2022-30765
SQL injection in calibreweb
Średnia
CVE-2014-3146
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to
Wysoka
CVE-2015-5162
OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption
Wysoka
CVE-2016-7401
The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting a
Krytyczna
CVE-2016-8638
Session Fixation in ipsilon
Krytyczna
CVE-2017-7214
OpenStack Nova logs sensitive context from notification exceptions
Średnia
CVE-2017-1000482
Products.CMFPlone XSS in profile home_page property
Krytyczna
CVE-2017-1000469
Cobbler vulnerable to arbitrary code execution
Wysoka
CVE-2011-4138
The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for t
Wysoka
CVE-2011-4139
Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a cr
Krytyczna
CVE-2012-0805
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select
Średnia
CVE-2017-1000481
Products.CMFPlone Open Redirect Vulnerability
Wysoka
CVE-2018-7490
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.
Wysoka
CVE-2018-1000167
OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Function as used in the following files: config.py:136, config.py:142, sources.py:99 a
Wysoka
CVE-2014-6633
Tryton vulnerable to arbitrary command execution
Średnia
CVE-2018-12104
Cross-site scripting (XSS) vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post
Krytyczna
CVE-2011-4104
The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to t
Wysoka
CVE-2015-3220
The tlslite library before 0.4.9 for Python allows remote attackers to trigger a denial of service (runtime exception and process crash).
Wysoka
CVE-2015-4017
Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules.
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.