SUSE CVE-2023-30861

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session...

WordPress Order Your Posts Manually Plugin <= 2.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Order Your Posts Manually Type Plugin Vulnerable versions = 2.2.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32510 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fdf3da041b8c Credits minhtuana...

cc.hiver:hiver-core (>=1.0 <=1.0.4), cn.eova:eova (>=1.5.0 <=1.6.0) +199 more potentially affected by CVE-2023-30331 via com.ibeetl:beetl (>=2.2.5 <=3.15.0.RELEASE)

com.ibeetl:beetl MAVEN version =2.2.5, =1.0, =1.5.0, =3.0.0, =1.0, =6.2, =0.1.2, =5.0.5, =5.1.5, =1.0.0, =1.0.0, =1.5.5 and more Source cves: CVE-2023-30331 Source advisory: OSV:GHSA-M69H-4FRQ-VWQ7...

PT-2023-2566

Name of the Vulnerable Software and Affected Versions Flask versions prior to 2.3.2 Flask versions prior to 2.2.5 Description The issue arises when a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches...

Silverstripe Form Capture vulnerable to stored cross-site-scripting

Impact Improper escaping when presenting stored form submissions allowed for an attacker to perform a Cross-Site Scripting attack Patches The vulnerability was initially patched in version 1.0.2, and version 1.1.0 includes this patch. The bug was then accidentally re-introduced during a merge...

Cross site scripting

Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users. Starting in version 0.2.0 and prior to versions 1.0.2, 1.1.0, 2.2.5, and 3.1.1, improper escaping when presenting stored form submissions allowed for an attacker to perform a...

CVE-2023-28851 Silverstripe Form Capture vulnerable to Stored Cross-Site Scripting

Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users. Starting in version 0.2.0 and prior to versions 1.0.2, 1.1.0, 2.2.5, and 3.1.1, improper escaping when presenting stored form submissions allowed for an attacker to perform a...

CVE-2023-28851 Silverstripe Form Capture vulnerable to Stored Cross-Site Scripting

Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users. Starting in version 0.2.0 and prior to versions 1.0.2, 1.1.0, 2.2.5, and 3.1.1, improper escaping when presenting stored form submissions allowed for an attacker to perform a...

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users. Starting in version 0.2.0 and prior to versions 1.0.2, 1.1.0, 2.2.5, and 3.1.1, improper escaping when presenting stored form submissions allowed for an attacker to perform a...

SUSE CVE-2017-6362

Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vectors related to a palette with no colors...

SUSE CVE-2017-8313

Heap out-of-bound read in ParseJSS in VideoLAN VLC before 2.2.5 due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process via a crafted subtitles file...

CLSA-2022-1663184139 Fixed CVE-2021-28861 in python3

CVE-2021-28861: fix redirection vulnerability in http.server - fix tests to be compatible with expat 2.2.5...

acryl-datahub-airflow-plugin (>=0.8.44.4 <=0.9.2.1rc2), airflow-add-ons (>=0.2.9b1 <=0.2.9b2) +11 more potentially affected by CVE-2022-38054 via apache-airflow (>=2.2.5 <=2.3.4)

apache-airflow PYPI version =2.2.5, =0.8.44.4, =0.2.9b1, =0.8.0, =0.2.0, =0.0.3, =0.0.6, =0.0.1, =0.1.0, =0.4.0, =0.8.3, =0.2.35, =0.1.0, =0.10.0.1 Source cves: CVE-2022-38054 Source advisory: OSV:PYSEC-2022-263...

PT-2022-5836 · Jenkins · Jenkins Android Signing Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Android Signing Plugin versions 2.2.5 and earlier Description: The issue is related to a lack of permission check in a method implementing form validation. This allows attackers with Item/Read permission but without Item/Workspace or...

CVE-2022-31393

Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery SSRF vulnerability via the Index function in app/admin/c/PluginsController.php...

JIZHICMS 代码问题漏洞

Extreme Networks Technology JIZHICMS Extreme CMS is an open source content management system CMS from China's Extreme Networks Technology Company. A security vulnerability exists in JIZHICMS version v2.2.5, which originated from a server-side request forgery SSRF vulnerability discovered through...

Refined Toolkit for Confluence 跨站脚本漏洞

Refined Toolkit for Confluence is a set of tools for refining Confluence pages and spaces. A security vulnerability exists in Refined Toolkit for Confluence version 2.2.5, which can be exploited by an attacker to remotely launch a cross-site scripting attack...

ShopXO 安全漏洞

ShopXO is an open source enterprise-level open source e-commerce system. ShopXO version 2.2.5 and previous versions of a security vulnerability , the vulnerability stems from the app/install/controller/Index.php in the Add function found to contain the system reinstallation vulnerability...

PT-2022-6941 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions 1.5.0 through 2.1.10 Argo CD versions 2.2.0 through 2.2.5 Argo CD versions 2.3.0 and earlier, excluding 2.3.0 Description: A path traversal vulnerability in Argo CD allows a malicious user with read/write access to leak...

WordPress Document Viewer for Office plugin <= 2.2.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Document Viewer for Office plugin versions = 2.2.4. Solution Update the WordPress Document Viewer for Office plugin to the latest available version at least 2.2.5...