CVE-2022-48547

A reflected cross-site scripting XSS vulnerability in Cacti 0.8.7g and earlier allows unauthenticated remote attackers to inject arbitrary web script or HTML in the "ref" parameter at authchangepassword.php...

PT-2023-5430 · Cacti · Cacti

Name of the Vulnerable Software and Affected Versions: Cacti versions 0.8.7g and earlier Description: A reflected cross-site scripting XSS vulnerability allows unauthenticated remote attackers to inject arbitrary web script or HTML in the ref parameter at "auth changepassword.php". This issue is...

PT-2023-12875

Name of the Vulnerable Software and Affected Versions libsass version 3.6.5 Description The issue is a Stack Overflow vulnerability in the CompoundSelector::has real parent ref function. Recommendations For libsass version 3.6.5, at the moment, there is no information about a newer version that...

CVE-2022-48547: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in Cacti 0.8.7g and earlier allows unauthenticated remote attackers to inject arbitrary web script or HTML in the "ref" parameter at authchangepassword.php...

CBEthCollateral and AnkrStakedEthCollateral _underlyingRefPerTok is incorrect

Lines of code Vulnerability details The CBEthCollateral.underlyingRefPerTok function just uses CBEth.exchangeRate to get the ref/tok rate. The CBEth.exchangeRate can only get the conversion rate from cbETH to staked ETH2 on the coinbase. However as the docs...

CVE-2010-10010: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic has been found in Stars Alliance PsychoStats up to 3.2.2a. This affects an unknown part of the file upload/admin/login.php. The manipulation of the argument ref leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to...

Medium: mariadb

Issue Overview: getsortbytable in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY. CVE-2021-46657 MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECTLEX::nestlevel is local to each VIEW. CVE-2021-46659 MariaDB through...

PT-2023-23164 · Nextcloud · Nextcloud Cookbook

Name of the Vulnerable Software and Affected Versions: NextCloud Cookbook versions prior to commit a46d9855 on the master branch and commit 489bb744 on the main-0.9.x branch Description: The issue concerns a command injection vulnerability due to the use of an untrusted github.head ref field in t...

kernel: use-after-free in bss_ref_get in net/wireless/scan.c

A use-after-free flaw was found in bssrefget in the net/wireless/scan.c in the Linux kernel. This issue can lead to a denial of service or arbitrary code execution...

kernel: use-after-free in bss_ref_get in net/wireless/scan.c

A use-after-free flaw was found in bssrefget in the net/wireless/scan.c in the Linux kernel. This issue can lead to a denial of service or arbitrary code execution...

CVE-2023-1178

An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. File integrity may be compromised when source code or installation packages are pulled from a tag or from a...

libavc:svc_dec_fuzzer: Heap-buffer-overflow in isvcd_reflayer_construction_dyadic

Project: https://android.googlesource.com/platform/external/libavc https://github.com/ittiam-systems/libavc.git Detailed Report: https://oss-fuzz.com/testcase?key=5103935095701504 Project: libavc Fuzzing Engine: afl Fuzz Target: svcdecfuzzer Job Type: aflasanlibavc Platform Id: linux Crash Type:...

PT-2023-12238

Name of the Vulnerable Software and Affected Versions Dvidelabs flatcc version 0.6.0 Description The issue allows a local attacker to execute arbitrary code via the execution of the error ref sym function. This is a Buffer Overflow vulnerability. Recommendations For Dvidelabs flatcc version 0.6.0...

SUSE CVE-2019-13139

In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command execution. An issue exists in the way "docker build" processes remote git URLs, and results in command injection into the underlying "git...

SUSE CVE-2020-10673

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef aka caucho-quercus...

SUSE CVE-2021-26247

As an unauthenticated remote user, visit "http:///authchangepassword.php?ref=alert1" to successfully execute the JavaScript payload present in the "ref" URL parameter...

GSD-2023-1001879 drm/i915: Fix request ref counting during error capture & debugfs dump

drm/i915: Fix request ref counting during error capture & debugfs dump This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.11 by commit...

PT-2023-35058 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.8 Description: The issue is related to the btrfs function run one delayed ref, which always reports an error. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

PT-2023-35256

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.165 Description The issue is related to the btrfs function run one delayed ref, which always reports an error. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

PT-2023-35190

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.90 Description The issue is related to the btrfs function run one delayed ref, which always reports an error. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...