CVE-2022-2181

The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting...

PT-2022-3994

Name of the Vulnerable Software and Affected Versions PrestaShop versions 1.6.0.10 through 1.7.8.7 Description The issue is related to an SQL injection vulnerability in PrestaShop, an Open Source e-commerce platform. This vulnerability can be chained to call PHP's Eval function on attacker input,...

CVE-2017-20108

CVE-2017-20108 affects Easy Table Plugin 1.6 for WordPress. The vulnerability exists in /wordpress/wp-admin/options-general.php where input manipulation (notably including the string ">) can trigger a cross-site scripting (XSS) vulnerability. Exploitation is possible remotely. Documents consis...

WordPress plugin Clean-Contact 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Clean-Contact plugin 1.6 and earlier versions are vulnerable to cross-site request forgery, which...

CVE-2021-25121

The Rating by BestWebSoft WordPress plugin before 1.6 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service on the post/page when a user submit such rating...

PT-2022-21905 · Debian +1 · Debian +1

Name of the Vulnerable Software and Affected Versions: Checkmk versions 1.6 through 1.6.9p29 Checkmk versions 2.0 through 2.0.0p26 Checkmk versions 2.1 through 2.1.0p3 Checkmk version 2.2.0i1 Description: A permission issue affects users that deployed the shipped version of the Checkmk Debian...

GHSA-HJ36-V72X-CC6J Missing permission checks in Jenkins Database Plugin

A missing permission check in Jenkins database Plugin 1.6 and earlier allows attackers with Overall/Read access to Jenkins to connect to an attacker-specified database server using attacker-specified credentials. Database Plugin 1.7 requires Overall/Administer permission for the affected form...

CSRF vulnerability in Jenkins Database Plugin

Database Plugin 1.6 and earlier does not require POST requests for the database console, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to execute arbitrary SQL scripts. Database Plugin 1.7 removes the database console...

Missing permission checks in Jenkins Database Plugin

A missing permission check in Jenkins database Plugin 1.6 and earlier allows attackers with Overall/Read access to Jenkins to connect to an attacker-specified database server using attacker-specified credentials. Database Plugin 1.7 requires Overall/Administer permission for the affected form...

CVE-2022-29249

JavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of locked text by unauthorized actors. The issue is NOT critical for non-secure applications, however may be critical in a situation where the highest levels of security are required...

CVE-2022-29249 Reversible One-Way Hash and Use of a Broken or Risky Cryptographic Algorithm in io.github.javaezlib.JavaEZ

JavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of locked text by unauthorized actors. The issue is NOT critical for non-secure applications, however may be critical in a situation where the highest levels of security are required...

CVE-2022-29249 Reversible One-Way Hash and Use of a Broken or Risky Cryptographic Algorithm in io.github.javaezlib.JavaEZ

JavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of locked text by unauthorized actors. The issue is NOT critical for non-secure applications, however may be critical in a situation where the highest levels of security are required...

JavaEZ 加密问题漏洞

JavaEZ is a library. New functions have been added to make Java easier. A security vulnerability exists in JavaEZ version 1.6, which can be exploited by an unauthorized attacker to forcibly decrypt locked text...

PT-2022-19496 · Javaez · Javaez

Name of the Vulnerable Software and Affected Versions: JavaEZ version 1.6 Description: A weakness in JavaEZ allows force decryption of locked text by unauthorized actors. The issue may be critical in situations where the highest levels of security are required, but it is not critical for non-secu...

CVE-2022-26530

swaylock before 1.6 allows attackers to trigger a crash and achieve unlocked access to a Wayland compositor...

Django Vulnerable to Cache Poisoning

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the 1 Vary: Cookie or 2 Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers...

GHSA-9CWG-MHXF-HH59 Django cross-site scripting (XSS) vulnerability via is_safe_url function

The issafeurl function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting XSS or other vulnerabilities into Django applications that use this function, a...

Kubernetes arbitrary file overwrite

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running...

Kubernetes arbitrary file overwrite

In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files...

GHSA-2JQ6-FFPH-P4H8 Kubernetes arbitrary file overwrite

In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files...