CVE-2023-22731: Improper Control of Generation of Code

Shopware is an open source commerce platform based on Symfony Framework and Vue js. In a Twig environment without the Sandbox extension, it is possible to refer to PHP functions in twig filters like map, filter, sort. This allows a template to call any global PHP function and thus execute arbitra...

PT-2023-34286

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.86 Description A reference count leak was discovered in the snr uncore mmio map function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior ...

PT-2023-34024

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.87 Description The issue is related to a use-after-free in the extent map when handling a missing device in read one chunk. The actual impact and attack plausibility have not yet been proven. Recommendation...

WordPress Map Multi Marker Plugin <= 3.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Map Multi Marker Type Plugin Vulnerable versions = 3.2.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-47591 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0fa0897cb0de Credits minhtuanact Requir...

Map Multi Marker <= 3.2.1 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2021-26409

Insufficient bounds checking in SEV-ES may allow an attacker to corrupt Reverse Map table RMP memory, potentially resulting in a loss of SNP Secure Nested Paging memory integrity...

CVE-2021-26409

Insufficient bounds checking in SEV-ES may allow an attacker to corrupt Reverse Map table RMP memory, potentially resulting in a loss of SNP Secure Nested Paging memory integrity...

Out-of-bounds

Insufficient bounds checking in SEV-ES may allow an attacker to corrupt Reverse Map table RMP memory, potentially resulting in a loss of SNP Secure Nested Paging memory integrity...

Naver Map <= 1.1.0 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. naver-map y='" onmouseover="alert1"...

Naver Map <= 1.1.0 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC naver-map y='" onmouseover="alert1"...

WordPress Naver Map Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Naver Map Type Plugin Vulnerable versions = 1.1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0146 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 9b11490559da Credits István Márton Required...

CVE-2021-26409

Insufficient bounds checking in SEV-ES may allow an attacker to corrupt Reverse Map table RMP memory, potentially resulting in a loss of SNP Secure Nested Paging memory integrity...

CVE-2021-26409

Insufficient bounds checking in SEV-ES may allow an attacker to corrupt Reverse Map table RMP memory, potentially resulting in a loss of SNP Secure Nested Paging memory integrity...

CVE-2021-26409: Buffer Copy without Checking Size of Input

Insufficient bounds checking in SEV-ES may allow an attacker to corrupt Reverse Map table RMP memory, potentially resulting in a loss of SNP Secure Nested Paging memory integrity...

PT-2023-1404 · Amd · Amd Secure Encrypted Virtualization-Encrypted State

Name of the Vulnerable Software and Affected Versions: AMD Secure Encrypted Virtualization-Encrypted State SEV-ES affected versions not specified Description: The issue is related to insufficient bounds checking in the implementation of AMD Secure Encrypted Virtualization-Encrypted State SEV-ES...

AMD Server Vulnerabilities – January 2023

Bulletin ID: AMD-SB-1032 Potential Impact: Varies by CVE, see descriptions below Severity: Varies by CVE, see descriptions below Summary During security reviews in collaboration with Google, Microsoft, and Oracle, potential vulnerabilities in the AMD Secure Processor ASP, AMD System Management Un...

PT-2023-33069 · Unknown · Pocketmine-Mp

Name of the Vulnerable Software and Affected Versions: PocketMine-MP affected versions not specified Description: The issue arises from the DyeColorIdMap-fromId function not handling invalid input properly, leading to an undefined offset error. This function is indirectly called during the...

PT-2025-37695

Name of the Vulnerable Software and Affected Versions linux affected versions not specified Description The Linux kernel contains a flaw in the cacheinfo functionality where the shared cpu map is incorrectly handled when caches at different levels are shared between CPUs. This can lead to a...

GHSA-J563-GRX4-PJPV XStream can cause Denial of Service via stack overflow

Impact The vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream. Patches XStream 1.4.20 handles the stack overflow and raises an InputManipulationException instead...

WordPress 10Web Map Builder for Google Maps Plugin < 1.0.72 is vulnerable to Cross Site Scripting (XSS)

Software 10Web Map Builder for Google Maps Type Plugin Vulnerable versions 1.0.72 Fixed in 1.0.72 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4758 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID 6eb19701ed4e Credits...