1274 matches found
CVE-2022-1035
GPAC: CVE-2022-1035 is a segmentation fault in MP4Box -lsr affecting gpac/gpac prior to 2.1.0-DEV. Connected sources indicate GPAC multiple-vulnerability advisories across Debian and Gentoo and confirm remediation via upgrading to newer GPAC versions (e.g., Gentoo GL SA recommends >= gpac-2.2....
CVE-2022-1035 Segmentation Fault caused by MP4Box -lsr in gpac/gpac
Segmentation Fault caused by MP4Box -lsr in GitHub repository gpac/gpac prior to 2.1.0-DEV...
WordPress Grid Kit Portfolio plugin <= 2.0.0 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Grid Kit Portfolio plugin versions = 2.0.0. Solution Update the WordPress Grid Kit Portfolio plugin to the latest available version at least 2.1.0...
Cross-site Scripting in Alist
Alist versions 2.0.10 through 2.1.0 were discovered to contain a cross-site scripting XSS vulnerability via /i/:data/ipa.plist. This issue was fixed in version 2.1.1...
GHSA-4GR7-QW2Q-JXH6 Cross-site Scripting in Nacos
A Cross Site Scripting XSS vulnerability exists in Nacos prior to 1.4.5 and 2.1.0-BETA in auth/users via the 1 pageSize and 2 pageNo parameters...
Input validation
The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is...
Amazon Linux 2 : expat (ALAS-2022-1764)
The version of expat installed on the remote host is prior to 2.1.0-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1764 advisory. A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML...
Cross site scripting
The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.0 does not sanitise and escape the wmcccontenttype, wmccsourceblog and wmccrecordperpage parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues...
GHSA-XVM2-9XVC-HX7F Improper Restriction of XML External Entity Reference in com.monitorjbl:xlsx-streamer
Impact Prior to xlsx-streamer 2.1.0, the XML parser that was used did not apply all the necessary settings to prevent XML Entity Expansion issues. Patches Upgrade to version 2.1.0. Workarounds No known workaround. References...
Design/Logic Flaw
Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was used did apply all the necessary settings to prevent XML Entity Expansion issues. Upgrade to version 2.1.0 to receive a patch. There is no...
CVE-2022-23640 Improper Restriction of XML External Entity Reference in Excel-Streaming-Reader
Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was used did apply all the necessary settings to prevent XML Entity Expansion issues. Upgrade to version 2.1.0 to receive a patch. There is no...
PT-2022-16153 · Unknown · Xlsx-Streamer
Name of the Vulnerable Software and Affected Versions: xlsx-streamer versions prior to 2.1.0 Description: The issue concerns the XML parser used in the Excel-Streaming-Reader, which did not apply all necessary settings to prevent XML Entity Expansion issues. This problem is resolved by upgrading ...
Improper Input Validation
Overview url-js is a Simple URL parser, similar to DOM URL Affected versions of this package are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\localhost and http://localhost are the same URL. However, the...
CVE-2021-31814
In Stormshield 1.1.0, and 2.1.0 through 2.9.0, an attacker can block a client from accessing the VPN and can obtain sensitive information through the SN VPN SSL Client...
PT-2022-10052 · Unknown · Stormshield
Name of the Vulnerable Software and Affected Versions: Stormshield versions 1.1.0 Stormshield versions 2.1.0 through 2.9.0 Description: An issue exists where an attacker can block a client from accessing the VPN and obtain sensitive information through the SN VPN SSL Client. Recommendations: For...
ai.grakn:grakn (>=0.13.0 <=0.14.0), ai.grakn:grakn-client (>=0.13.0 <=0.14.0) +181 more potentially affected by CVE-2020-17516 via org.apache.cassandra:cassandra-all (>=2.1.0 <=3.0.23)
org.apache.cassandra:cassandra-all MAVEN version =2.1.0, =0.13.0, =0.13.0, =0.13.0, =0.13.0, =0.7.0, =0.13.0, =0.13.0, =0.13.0, =0.13.0, =0.13.0, =0.13.0, =0.10.0, =0.13.0, =0.15.0, =0.6.1, =0.10.0 and more Source cves: CVE-2020-17516 Source advisory: OSV:GHSA-2VXM-VP4C-FJFW...
WordPress ScrollMe theme <= 2.1.0 - Authenticated Arbitrary Plugin Activation/Deactivation vulnerability
Authenticated Arbitrary Plugin Activation/Deactivation vulnerability discovered by Ex.Mi Patchstack in WordPress ScrollMe theme versions = 2.1.0. Solution Deactivate and delete. The vendor ignores the vulnerability reports, avoids any conversation...
CVE-2021-44829
Cross Site Scripting XSS vulnerability exists in index.html in AFI WebACMS through 2.1.0 via the the ID parameter...
org.apache.syncope.ext.flowable:syncope-ext-flowable-client-enduser (>=2.1.3 <=2.1.14), org.apache.syncope.ext.oidcclient:syncope-ext-oidcclient-client-enduser (>=2.1.0 <=2.1.14) +1 more potentially affected by CVE-2019-17557 via org.apache.syncope.client:syncope-client-enduser (>=2.1.0 <=2.1.5)
org.apache.syncope.client:syncope-client-enduser MAVEN version =2.1.0, =2.1.3, =2.1.0, =2.1.0, =2.1.14 Source cves: CVE-2019-17557 Source advisory: OSV:GHSA-6QJ8-C27W-RP33...