721 matches found
NewStart CGSL MAIN 6.02 : freerdp Multiple Vulnerabilities (NS-SA-2022-0063)
The remote NewStart CGSL host, running version MAIN 6.02, has freerdp packages installed that are affected by multiple vulnerabilities: - In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in accessing a memory location that is outside of the boundaries of the static array...
CVE-2022-29425
Cross-Site Scripting XSS vulnerability in WP Wham's Checkout Files Upload for WooCommerce plugin = 2.1.2 at WordPress...
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Overview git-interface is an interface to work with a git repository in node.js Affected versions of this package are vulnerable to Improper Neutralization of Argument Delimiters in a Command 'Argument Injection'. The API may be abused if user input is able to provide a valid directory on disk an...
RHEL 8 : Red Hat OpenShift Service Mesh 2.1.2 (RHSA-2022:1275)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1275 advisory. Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise...
CVE-2021-25038
The WordPress Multisite User Sync/Unsync WordPress plugin before 2.1.2 does not sanitise and escape the wmussourceblog and wmusrecordperpage parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues...
Mageia: Security Advisory (MGASA-2016-0362)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PT-2022-9537 · WordPress · The Ultimate Faq
Name of the Vulnerable Software and Affected Versions: The Ultimate FAQ WordPress plugin versions prior to 2.1.2 Description: The issue concerns the lack of capability and CSRF checks in the ewd ufaq welcome add faq and ewd ufaq welcome add faq page AJAX actions. This allows any authenticated use...
Ultimate FAQ < 2.1.2 - Subscriber+ Arbitrary FAQ Creation
The plugin does not have capability and CSRF checks in the ewdufaqwelcomeaddfaq and ewdufaqwelcomeaddfaqpage AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions...
CVE-2021-45089
Stormshield Endpoint Security 2.x before 2.1.2 has Incorrect Access Control...
CVE-2021-45089
Stormshield Endpoint Security 2.x before 2.1.2 has Incorrect Access Control...
Stormshield Endpoint Security 安全漏洞
Stormshield Endpoint Security, the product line of the French company Stormshield for enhanced workstation and server security, has a remote code execution vulnerability in versions prior to 2.1.2, which stems from the process of constructing code segments from externally entered data. network...
PT-2021-22197 · Apache · Apache Airflow
Name of the Vulnerable Software and Affected Versions: Apache Airflow versions 2.0.0 through 2.1.2 Description: The issue concerns the variable import endpoint not being protected by authentication. This allows unauthenticated users to access the endpoint, potentially leading to denial of service...
PYSEC-2021-122
If remote logging is not used, the worker in the case of CeleryExecutor or the scheduler in the case of LocalExecutor runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG...
CVE-2021-35936 No Authentication on Logging Server
If remote logging is not used, the worker in the case of CeleryExecutor or the scheduler in the case of LocalExecutor runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG...
PT-2021-21067 · Apache · Apache Airflow
Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.1.2 Description: The issue affects the logging server in Apache Airflow, which has no authentication and allows reading log files of DAG jobs when remote logging is not used. This could potentially expose...
Privilege escalation
Pear Admin Think through 2.1.2 has an arbitrary file upload vulnerability that allows attackers to execute arbitrary code remotely. A .php file can be uploaded via admin.php/index/upload because app/common/service/UploadService.php mishandles fileExt...
Email Encoder < 2.1.2 - Reflected Cross Site Scripting
The plugin has an endpoint that requires no authentication and will render a user supplied value in the HTML response without escaping or sanitizing the data. PoC The vulnerable function is nonce protected, the nonce can be found in the site's HTML source by searching for the javascript variable...
CVE-2020-22284
The CVE-2020-22284 entry affects lwIP (Free Software Foundation) in git head and v2.1.2, where a buffer overflow in the zepif_linkoutput() function can be triggered by a crafted 6LoWPAN packet. This vulnerability could allow an attacker to access sensitive information as described in the NVD entr...
mruby resource management error vulnerability
mruby is a lightweight implementation of the Ruby language. A security vulnerability exists in Mruby 2.1.2, which stems from the fact that Mruby has a double free in the default allocf of the MRB.No details of the vulnerability are provided at this time...
