PT-2023-16247 · Modoboa · Modoboa

Name of the Vulnerable Software and Affected Versions: modoboa/modoboa versions prior to 2.0.4 Description: The issue is related to Cross-Site Request Forgery CSRF in the modoboa/modoboa GitHub repository. Recommendations: For versions prior to 2.0.4, update to version 2.0.4 or later to resolve t...

modoboa 跨站请求伪造漏洞

modoboa is an email hosting and management platform for individual developers. modoboa versions prior to 2.0.4 are vulnerable to cross-site request forgery. An attacker could exploit this vulnerability to perform cross-site request forgery CSRF attacks...

modoboa 跨站请求伪造漏洞

modoboa is an email hosting and management platform for individual developers. modoboa versions prior to 2.0.4 are vulnerable to cross-site request forgery. An attacker could exploit this vulnerability to perform cross-site request forgery CSRF attacks...

CVE-2023-0406 Cross-Site Request Forgery (CSRF) in modoboa/modoboa

Cross-Site Request Forgery CSRF in GitHub repository modoboa/modoboa prior to 2.0.4...

CVE-2023-0398 Cross-Site Request Forgery (CSRF) in modoboa/modoboa

Cross-Site Request Forgery CSRF in GitHub repository modoboa/modoboa prior to 2.0.4...

WordPress Better Font Awesome Plugin < 2.0.4 is vulnerable to Cross Site Scripting (XSS)

Software Better Font Awesome Type Plugin Vulnerable versions 2.0.4 Fixed in 2.0.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4512 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 3f338a1f451d Credits Lana Codes...

AZL-43546 CVE-2022-4743 affecting package SDL2 2.24.0-2

A potential memory leak issue was discovered in SDL2 in GLESCreateTexture function in SDLrendergles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected...

CVE-2022-4743

A potential memory leak issue was discovered in SDL2 in GLESCreateTexture function in SDLrendergles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected...

WordPress plugin Jeeng Push Notifications 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. Cross-site scripting...

[SECURITY] Fedora 37 Update: python-mistune-2.0.4-1.fc37

The fastest markdown parser in pure Python, inspired by marked...

Seed Social < 2.0.4 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Put the following payload in any of the plugin...

GHSA-HHQ3-FF78-JV3G loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)

A regular expression denial of service ReDoS flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils via the resourcePath variable in interpolateName.js. A badly or maliciously formed string could be used to send crafted requests that cause a system to crash or ta...

Path traversal

Panini Everest Engine 2.0.4 allows unprivileged users to create a file named Everest.exe in the %PROGRAMDATA%\Panini folder. This leads to privilege escalation because a service, running as SYSTEM, uses the unquoted path of %PROGRAMDATA%\Panini\Everest Engine\EverestEngine.exe and therefore a...

PT-2022-24837 · Nuprocess · Nuprocess

Name of the Vulnerable Software and Affected Versions: NuProcess versions 1.2.0 through 2.0.4 Description: NuProcess is an external process execution implementation for Java that is vulnerable to command line injection attacks. Attackers can use NUL characters in their strings to inject command...

react-native-url-preview (=1.1.9), react-native-url-preview-tgp (=1.1.9) +1 more potentially affected by CVE-2022-25876 via link-preview-js (>=2.0.4 <=2.1.13)

link-preview-js NPM version =2.0.4, =2.1.4, =2.2.0 Source cves: CVE-2022-25876 Source advisory: SNYK:JS-LINKPREVIEWJS-2933520...

PT-2022-22046 · Jenkins · Jenkins Embeddable Build Status Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Embeddable Build Status Plugin versions 2.0.3 and earlier Description: The issue allows attackers without Overall/Read permission to specify paths to other SVG images on the Jenkins controller file system by exploiting a relative path...

PT-2022-22045 · Jenkins · Jenkins Embeddable Build Status Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Embeddable Build Status Plugin version 2.0.3 Description: The issue allows specifying a link query parameter for build status badges without restricting possible values, resulting in a reflected cross-site scripting XSS vulnerability...

Ops CLI Deserialization of Untrusted Data vulnerability

Ops CLI version 2.0.4 and earlier is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary code execution when the checkoutrepo function is called on a maliciously crafted file. An attacker can leverage this to execute arbitrary code on the victim machine...

WordPress plugin XML Sitemap Generator 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress XML Sitemap Generator version 2.0.4 has a cross-site scripting vulnerability that can be exploited by attackers to conduct cross-site scriptin...

com.day.cq:cq-personalization (>=5.4.0 <=5.6.8), org.apache.sling:org.apache.sling.servlets.post (>=2.1.0 <=3.0.2) potentially affected by CVE-2012-3353 via org.apache.sling:org.apache.sling.jcr.contentloader (>=2.0.4-incubator <=2.1.4)

org.apache.sling:org.apache.sling.jcr.contentloader MAVEN version =2.0.4-incubator, =5.4.0, =2.1.0, =3.0.2 Source cves: CVE-2012-3353 Source advisory: OSV:GHSA-WJP3-4XCQ-598P...