Magento Stored Cross-site Scripting vulnerability in the admin panel

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with permissions to manage customer groups...

Magento 2 Community Edition XSS Vulnerability

A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...

GHSA-M3V2-R236-5XGQ Magento 2 Community Edition XSS Vulnerability

A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...

WordPress plugin Hover Effects 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Hover Effects plugin 2.1 and earlier versions have a local file inclusion vulnerability, which stem...

Celery local privilege escalation vulnerability

Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryddetach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving...

GHSA-5633-F33J-C6F7 Tampering vulnerability in .NET Core

A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1...

Tampering vulnerability in .NET Core

A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1...

GHSA-JCRJ-GMR6-P5J8 Moodle Allows Modification of Constants

The MoodleQuickForm class in the Forms Library in lib/formslib.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not recognize Forms API setConstant operations, which allows remote attackers to submit unexpected form content by modifying the values of constant...

CVE-2022-30063

CVE-2022-30063 affects ftcms version 2.1 and earlier. The issue enables remote code execution (highest impact) with network access and no privileges required per the accompanying metrics (CVSSv3.1: 9.8 CRITICAL; CVSSv2: 7.5 HIGH). No explicit root-cause details or remediation are provided in the ...

ftcms 路径遍历漏洞

ftcms is a content management system from ftcms Inc. A security vulnerability exists in ftcms version 2.1 and earlier versions, which can be exploited by an attacker to read arbitrary files via tp.php...

Denial of service

In GPAC 2.1-DEV-rev87-g053aae8-master, function BSReadByte in utils/bitstream.c has a failed assertion, which causes a Denial of Service. This vulnerability was fixed in commit 9ea93a2...

CVE-2022-29339

CVE-2022-29339 affects GPAC 2.1-DEV-rev87-g053aae8-master; the Denial of Service is caused by a failed assertion in BS_ReadByte() within utils/bitstream.c. The vulnerability is mitigated by the fix introduced in commit 9ea93a2 (upstream GPAC). Exploitation details beyond this are not provided in ...

CVE-2022-29339

Removed by vendor...

Apache Geronimo Application Server multiple cross-site scripting (XSS) vulnerabilities

Multiple cross-site scripting XSS vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the 1 name, 2 ip, 3 username, or 4 description parameter to console/portal/Server/Monitorin...

networkd-dispatcher 安全漏洞

networkd-dispatcher is a scheduler daemon for systemd-networkd connection state changes by an individual developer at clayton craft in the United States. A security vulnerability exists in networkd-dispatcher versions 1.0 - 2.1 due to a race condition between a discovered script and a running...

GalleryCMS Cross-Site Scripting Vulnerability

GalleryCMS is a free image gallery CMS based on the CodeIgniter 2.1 framework from Aaron Benson, a US-based individual developer. GalleryCMS v2.0 is vulnerable to a cross-site scripting vulnerability that stems from a lack of data validation in the albumname parameter in /index.php/album/add for...

Security Bulletin: Images built from IBM App Connect Enterprise Certified Containers may be vulnerable to arbitrary code execution due to CVE-2021-37712

Summary The Node.js tar module is used by the package manager npm, which is included in the IBM App Connect Enterprise Certified Container images. Use of npm when building images based on IBM App Connect Enterprise Certified Container images may be vulnerable to arbitrary code execution. This...

Segmentation Fault caused by MP4Box -lsr

Version: MP4Box -version MP4Box - GPAC version 2.1-DEV-rev48-gf6d6225a9-master c 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io/ MINI build encoders, decoders, audio and video output disabled Please cite our work in your research: GPAC Filters:...

EulerOS 2.0 SP5 : mailman (EulerOS-SA-2022-1277)

According to the versions of the mailman package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Cross-site request forgery CSRF vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the...

EulerOS 2.0 SP3 : mailman (EulerOS-SA-2022-1177)

According to the versions of the mailman package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Cross-site request forgery CSRF vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the...