PT-2023-20692 · Apache · Apache Sling Resource Merger

Name of the Vulnerable Software and Affected Versions: Apache Sling Resource Merger versions 1.2.0 through 1.4.2 Description: The issue is related to an Excessive Iteration vulnerability in the Apache Sling Resource Merger. Recommendations: For versions 1.2.0 through 1.4.2, update to version 1.4....

Apache Sling 安全漏洞

Apache Sling is the United States Apache Apache Foundation of a Java platform for open source Web framework. It is designed to create content-centric applications on JSR-170-compliant content repositories such as Apache Jackrabbit. A security vulnerability exists in Apache Sling Resource Merger...

CVE-2023-28115

Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.4.2, Snappy is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the fileexists function. If an attacker can upload files of any...

CVE-2023-28115

Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.4.2, Snappy is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the fileexists function. If an attacker can upload files of any...

Deserialization of untrusted data

Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.4.2, Snappy is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the fileexists function. If an attacker can upload files of any...

UBUNTU-CVE-2023-28115

Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.4.2, Snappy is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the fileexists function. If an attacker can upload files of any...

CVE-2023-28115 Snappy vulnerable to PHAR deserialization, allowing remote code execution

Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.4.2, Snappy is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the fileexists function. If an attacker can upload files of any...

CVE-2023-28115

Removed by vendor...

PT-2023-2176

Name of the Vulnerable Software and Affected Versions Snappy versions prior to 1.4.2 Description The issue is related to PHAR deserialization due to a lack of checking on the protocol before passing it into the file exists function. If an attacker can upload files of any type to the server, they...

Snappy 代码问题漏洞

Snappy is a PHP library from the individual developers at KNP Labs that allows thumbnails, snapshots or PDFs to be generated from url or html pages. A code issue vulnerability exists in versions of Snappy prior to 1.4.2 that stems from a lack of protocol checks. An attacker can exploit this...

PT-2023-20030 · Swig +1 · Swig +1

Name of the Vulnerable Software and Affected Versions: swig-templates versions 2.0.4 and earlier swig versions 1.4.2 and earlier Description: A directory traversal issue allows attackers to read arbitrary files via the include or extends tags. This can be exploited by attackers to access sensitiv...

PT-2023-10009 · Mmdeveloper · Mmdeveloper A Forms Plugin

Name of the Vulnerable Software and Affected Versions: MMDeveloper A Forms Plugin versions up to 1.4.2 Description: A problematic issue was found in the MMDeveloper A Forms Plugin, affecting an unknown part of the file a-forms.php. This issue leads to cross-site scripting and can be initiated...

Wordpress Plugin MMDeveloper A Forms 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

K11330713: jQuery vulnerability CVE-2014-6071

Security Advisory Description jQuery 1.4.2 allows remote attackers to conduct cross-site scripting XSS attacks via vectors related to use of the text method inside after. CVE-2014-6071 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory Status F5 Produ...

SUSE CVE-2005-0836

Argument injection vulnerability in Java Web Start for J2SE 1.4.2 up to 1.4.206 allows untrusted applications to gain privileges via the value parameter of a property tag in a JNLP file...

SUSE CVE-2005-1974

Unspecified vulnerability in Java 2 Platform, Standard Edition J2SE 5.0 and 5.0 Update 1 and J2SE 1.4.2 up to 1.4.207, as used in multiple products and platforms including 1 HP-UX and 2 APC PowerChute, allows applications to assign permissions to themselves and gain privileges...

SUSE CVE-2022-24795

yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to subsequent heap memory corruption when dealing with large 2GB inputs. The reallocation logic at yajlbuf.cL64 may result in the need 32bit...

WordPress plugin Photon WP Material Design Icons for Page Builders 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

BTicino DoorEntry HOMETOUCH 信任管理问题漏洞

BTicino DoorEntry HOMETOUCH is an application from the Italian company BTicino. It can be connected to video intercoms inside and outside the home. A vulnerability with trust management issues exists in BTicino DoorEntry HOMETOUCH iOS version 1.4.2, which stems from a missing SSL certificate...

WordPress Material Design Icons for Page Builders Plugin <= 1.4.2 is vulnerable to Cross Site Scripting (XSS)

Software Material Design Icons for Page Builders Type Plugin Vulnerable versions = 1.4.2 Fixed in 1.4.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-24374 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ca964ff46b5b Credits...