Apache StreamPark: Authenticated system users could trigger SQL injection vulnerability

In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fuzzy search, such as job names, role names, etc. The sql syntax :select from table where jobName like '%jobName%'. However, the jobName field may receive illegal parameters,...

CVE-2023-30867

In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fuzzy search, such as job names, role names, etc. The sql syntax :select from table where jobName like '%jobName%'. However, the jobName field may receive illegal parameters,...

CVE-2023-30867 Apache StreamPark (incubating): Authenticated system users could trigger SQL injection vulnerability

In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fuzzy search, such as job names, role names, etc. The sql syntax :select from table where jobName like '%jobName%'. However, the jobName field may receive illegal parameters,...

CVE-2023-43701 Apache Superset: Stored XSS on API endpoint

Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's metadata, this code could get executed if a user specifically accesses a specific deprecated API endpoint. This issue affects Apache...

CVE-2023-42501 Apache Superset: Unnecessary read permissions within the Gamma role

Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This issue affects Apache Superset: before 2.1.2. Users should upgrade to version or above 2.1.2 and run superset init to reconstruct the Gamma role or remove canre...

Apache Superset 安全漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. An information disclosure vulnerability exists in Apache Superset versions prior to 2.1.2, which can be exploited by an authenticated attacker to read configured CSS templates and comments...

PT-2023-28919

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 2.1.2 Description The issue is caused by improper payload validation and an improper REST API response type. This allows an authenticated malicious actor to store malicious code into Chart's metadata. The code...

PT-2023-28376

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 2.1.2 Description The issue allows authenticated users to read configured CSS templates and annotations due to unnecessary read permissions within the Gamma role. Recommendations For versions prior to 2.1.2,...

CVE-2023-32579

Cross-Site Request Forgery CSRF vulnerability in Designs & Code Forget About Shortcode Buttons plugin = 2.1.2 versions...

CVE-2023-34171

A vulnerability in Alex Raven WP Report Post wp-report-post.This issue affects WP Report Post: from n/a through = 2.1.2...

CVE-2023-34171

Cross-Site Request Forgery CSRF vulnerability in Alex Raven WP Report Post plugin = 2.1.2 versions...

CVE-2023-34171 WordPress WP Report Post Plugin <= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Alex Raven WP Report Post plugin = 2.1.2 versions...

AZL-31746 CVE-2023-46316 affecting package traceroute for versions less than 2.1.3-1

In buc Traceroute 2.0.12 through 2.1.2 before 2.1.3, the wrapper scripts do not properly parse command lines...

CVE-2023-45769

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Alex Raven WP Report Post plugin = 2.1.2 versions...

UBUNTU-CVE-2023-46316

In buc Traceroute 2.0.12 through 2.1.2 before 2.1.3, the wrapper scripts do not properly parse command lines...

BIT-2020-15190

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the tf.rawops.Switch operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. Howeve...

Photospace Responsive < 2.1.2 - Admin+ Stored XSS

Description The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress WP Report Post Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)

Software WP Report Post Type Plugin Vulnerable versions = 2.1.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-45769 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d5598e546cea Credits Ivy TOOR, LISA...

CVE-2022-22298

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiIsolator version 1.0.0, FortiIsolator version 1.1.0, FortiIsolator version 1.2.0 through 1.2.2, FortiIsolator version 2.0.0 through 2.0.1, FortiIsolator version 2.1.0 through 2.1.2,...

Zip Swift 路径遍历漏洞

Zip Swift is a Swift framework for compressing and decompressing files by individual developer Roy Marmelstein in Sweden. A security vulnerability exists in Zip Swift version v2.1.2, which stems from a vulnerability that allows an attacker to perform a path traversal attack via a crafted zip entr...