EqualWeb Accessibility Widget 跨站脚本漏洞

The EqualWeb Accessibility Widget is an accessibility widget from EqualWeb. A security vulnerability exists in the EqualWeb Accessibility Widget, which stems from an incorrect validation of message events in its accessibility.js component that could allow an attacker to implement DOM-based...

CVAT 2.0 - Server Side Request Forgery Vulnerability

Exploit Title: CVAT 2.0 - SSRF Server Side Request Forgery Exploit Author: Emir Polat Vendor Homepage: https://github.com/opencv/cvat Version: 2.0.0 Tested On: Version 1.7.0 - Ubuntu 20.04.4 LTS GNU/Linux 5.4.0-122-generic x8664 CVE: CVE-2022-31188 Description: CVAT is an opensource interactive...

Security Bulletin: hsqldb-2.0.0.jar shipped with IBM Tivoli Business Service Manager is vulnerable to remote code execution (CVE-2022-41853)

Summary hsqldb is a component shipped with IBM Tivoli Business Service Manager. Information about a security vulnerability affecting hsqldb has been published in a security bulletin. hsqldb is no longer used and can be safely removed. Vulnerability Details CVEID:CVE-2022-41853 DESCRIPTION: HSQLDB...

Exploit for Improper Verification of Cryptographic Signature in Passport-Saml_Project Passport-Saml

Exploiting CVE-2022-39299 Signature bypass via multiple ro...

Apache Isis Cross-site Scripting vulnerability

Prior to 2.0.0-M9, it was possible for an end-user to set the value of an editable string property of a domain object to a value that would be rendered unchanged when the value was saved. In particular, the end-user could enter javascript or similar and this would be executed. As of this release,...

UBUNTU-CVE-2022-37599

A Regular expression denial of service ReDoS flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js...

CVE-2022-37599

A Regular expression denial of service ReDoS flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js...

Dell Container Storage Modules 操作系统命令注入漏洞

Dell Container Storage Modules are a set of modules from Dell, Inc. It is designed to provide additional functionality beyond what is available in container storage. An operating system command injection vulnerability exists in Dell Container Storage Modules versions 1.3.0 and later, prior to...

PT-2022-24021

Name of the Vulnerable Software and Affected Versions webpack loader-utils version 2.0.0 Description A Regular expression denial of service ReDoS flaw was found in the interpolateName function in interpolateName.js via the resourcePath variable. This issue could be exploited by sending crafted...

Sensio Labs Twig Path Traversal Vulnerability

Sensio Labs Twig is a PHP templating engine from Sensio Labs, France, which supports custom tags and filters and creates DSLs. A path traversal vulnerability exists in Sensio Labs Twig 1.0.0 and later, versions prior to 1.44.7, 2.0.0 and later, versions prior to 2.15.3, and 3.0.0 and later,...

GHSA-Q4Q5-C5CV-2P68 Vuetify Cross-site Scripting vulnerability

The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting XSS due to improper input sanitization in the 'eventName' function within the VCalendar component...

WordPress plugin Gettext override translations 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

UniSharp Laravel Filemanager directory traversal vulnerability

UniSharp laravel-filemanager aka Laravel Filemanager with league/flysystem version = 2.0.0...

NodeBB < 1.19.8, 2.x < 2.0.1 Account Takeover Vulnerability

NodeBB is prone to an account takeover vulnerability via a cryptographically weak PRNG in SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2022-34867 WordPress WP Libre Form 2 plugin <= 2.0.8 - Unauthenticated Sensitive Information Disclosure vulnerability

Unauthenticated Sensitive Information Disclosure vulnerability in WP Libre Form 2 plugin = 2.0.8 at WordPress allows attackers to list and delete submissions. Affects only versions from 2.0.0 to 2.0.8...

PT-2022-4655 · Nodebb · Nodebb

Name of the Vulnerable Software and Affected Versions: NodeBB Forum Software versions prior to 1.19.7 NodeBB Forum Software versions prior to 2.0.0 Description: The utils.generateUUID helper function in NodeBB Forum Software uses a cryptographically insecure pseudo-random number generator...

PYSEC-2022-43146

py-cord is a an API wrapper for Discord written in Python. Bots creating using py-cord version 2.0.0 are vulnerable to remote shutdown if they are added to the server with the application.commands scope without the bot scope. Currently, it appears that all public bots that use slash commands are...

CVE-2022-31188

CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side request forgery SSRF vulnerability. Validation has been added to urls used in the affected code path in version 2.0.0. Users are advised to...

CVE-2022-31188

CVAT (CVE-2022-31188) contains a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 2.0.0, tied to URL handling without proper validation. Version 2.0.0 introduced input validation in the affected code path, and users are advised to upgrade to 2.0.0 or later. There are no docum...

CVE-2022-33943 WordPress BxSlider WP plugin <= 2.0.0 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated contributor or higher user role Cross-Site Scripting XSS vulnerability in Nico Amarilla's BxSlider WP plugin = 2.0.0 at WordPress...