PT-2022-28152 · Froxlor · Froxlor

Name of the Vulnerable Software and Affected Versions: froxlor versions prior to 2.0.0-beta1 Description: The issue is related to Cross-Site Request Forgery CSRF in the GitHub repository froxlor/froxlor. CSRF is an attack that tricks a user into performing unintended actions on a web application...

Design/Logic Flaw

Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1...

CVE-2022-4864 Argument Injection in froxlor/froxlor

Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1...

PT-2022-28149 · Froxlor · Froxlor

Name of the Vulnerable Software and Affected Versions: froxlor versions prior to 2.0.0-beta1 Description: The issue is related to Argument Injection in the GitHub repository froxlor/froxlor. Recommendations: For versions prior to 2.0.0-beta1, update to version 2.0.0-beta1 or later to resolve the...

PT-2022-11701 · Openmrs · Openmrs Html Form Entry Ui Framework Integration Module

Name of the Vulnerable Software and Affected Versions: OpenMRS HTML Form Entry UI Framework Integration Module versions up to 1.x Description: A vulnerability has been found in the OpenMRS HTML Form Entry UI Framework Integration Module, which affects an unknown part and leads to cross-site...

CVE-2022-47931

IO FinNet tss-lib before 2.0.0 allows a collision of hash values...

PT-2022-28091 · Tss-Lib · Tss-Lib

Name of the Vulnerable Software and Affected Versions: tss-lib versions prior to 2.0.0 Description: The issue concerns a collision of hash values. This collision can potentially lead to security issues, although specific details about exploitation or affected devices are not provided...

IO FinNet tss-lib 加密问题漏洞

tss-lib is an open source IO FinNet implementation of the multi-party t,n- threshold ECDSA Elliptic Curve Digital Signature Algorithm based on Gennaro and Goldfeder 20201 and EdDSA Edwards Curve Digital Signature Algorithm. A security vulnerability exists in IO FinNet tss-lib versions prior to...

Hardcoded credentials

ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging. The request...

CVE-2022-39304 ghinstallation returns app JWT in error responses

ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging. The request...

CVE-2022-39304 ghinstallation returns app JWT in error responses

ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging. The request...

Jenkins Spring Config Plugin 跨站脚本漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A cross-site scripting...

CVE-2022-23466 DOM-based cross-site scripting (XSS) in teler dashboard

teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting XSS in the teler dashboard. When teler requests messages from the event stream on the /events endpoint, the log data displayed on the dashboard a...

CVE-2022-23466 DOM-based cross-site scripting (XSS) in teler dashboard

teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting XSS in the teler dashboard. When teler requests messages from the event stream on the /events endpoint, the log data displayed on the dashboard a...

GHSA-XR7P-8Q82-878Q teler dashboard vulnerable to DOM-based cross-site scripting (XSS)

Description teler prior to version = 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting XSS in the teler dashboard. When teler requests messages from the event stream on the /events endpoint, the log data displayed on the dashboard are not sanitized. Impact This only affects authenticated...

Kitabisa Teler 跨站脚本漏洞

Kitabisa Teler is a software from the Kitabisa team for implementing intrusion detection and threat alerts based on web logs. A cross-site scripting vulnerability exists in versions prior to Kitabisa Teler 2.0.0-rc.4, which stems from the fact that log data displayed on the dashboard is not clean...

CVE-2021-25059

The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site such as subscriber to download a full copy of the website...

PT-2022-27338 · Bosscms · Bosscms

Name of the Vulnerable Software and Affected Versions: Bosscms version 2.0.0 Description: The issue is related to a Cross-Site Request Forgery CSRF that was discovered in Bosscms. This CSRF is specifically via the Add function under the Administrator List module. Recommendations: For Bosscms...

PT-2022-9615 · WordPress · Download Plugin

Name of the Vulnerable Software and Affected Versions: The Download Plugin WordPress plugin versions prior to 2.0.0 Description: The issue arises from improper validation of user privileges to access a backup's nonce identifier. This may allow any users with an account on the site, such as...

PT-2022-6585 · Apache · Apache Streampark

Name of the Vulnerable Software and Affected Versions: Apache StreamPark versions 1.0.0 through 2.0.0 Description: The issue is related to an LDAP injection vulnerability, which is an attack used to exploit web-based applications that construct LDAP statements based on user input. When an...