1121 matches found
GHSA-6WGP-FWFM-MXP3 Django allows user sessions hijacking via an empty string in the session key
The session.flush function in the cacheddb backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key...
Django denial of service via empty session record creation
contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service session store consumption or session record removal via a large number of requests to...
PT-2022-20405 · Jenkins · Jenkins Wmi Windows Agents Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins WMI Windows Agents Plugin versions 1.8 and earlier Description: The issue is related to a buffer overflow vulnerability in the Windows Remote Command library included in the Jenkins WMI Windows Agents Plugin. This vulnerability may...
GHSA-M3X6-9V6H-4G28 Cross-site Scripting in Apache Struts
Cross-site scripting XSS vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter...
CVE-2022-29433
Authenticated contributor or higher role Cross-Site Scripting XSS vulnerability in Donations plugin = 1.8 on WordPress...
CVE-2022-29433 https://patchstack.com/database/vulnerability/nd-donations/wordpress-donations-plugin-1-8-authenticated-stored-cross-site-scripting-xss-vulnerability
Authenticated contributor or higher role Cross-Site Scripting XSS vulnerability in Donations plugin = 1.8 on WordPress...
CVE-2022-29433
Authenticated contributor or higher role Cross-Site Scripting XSS vulnerability in Donations plugin = 1.8 on WordPress...
Kubernetes arbitrary file overwrite
In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files...
GHSA-2JQ6-FFPH-P4H8 Kubernetes arbitrary file overwrite
In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files...
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting XSS vulnerability in the phpCAS client library before 1.1.0, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, which is not properly handled in an error message...
WordPress plugin Donations 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress plugin is an application plugin. WordPress...
GHSA-JJ23-FJ2V-M872 MoinMoin Improper Access Control vulnerability
MoinMoin 1.7.x before 1.7.3 and 1.8.x before 1.8.3 checks parent ACLs in certain inappropriate circumstances during processing of hierarchical ACLs, which allows remote attackers to bypass intended access restrictions by requesting an item, a different vulnerability than CVE-2008-6603...
Debian: Security Advisory (DLA-2986-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DLA 2986-1] golang-1.8 security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-2986-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler April 28, 2022 https://wiki.debian.org/LTS -...
DLA-2986-1 golang-1.8 - security update
Bulletin has no description...
Debian DLA-2986-1 : golang-1.8 - LTS security update
The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2986 advisory. - Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption. CVE-2022-23772 -...
Google Go 安全漏洞
Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google, Inc. A security vulnerability exists in Google Go that stems from a decoding stack overflow due to a large amount of PEM data. The following products and versions are affected:...
WordPress Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin <= 1.7 - Arbitrary Plugin Installation vulnerability
Arbitrary Plugin Installation vulnerability discovered by Jerome Bruandet NinTechNet in WordPress Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin versions = 1.7. Solution Update the WordPress Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin to the latest available...