906 matches found
CVE-2024-23328 The Dataease datasource exists deserialization and arbitrary file read vulnerability
Dataease is an open source data visualization analysis tool. A deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The location of the vulnerability code is core/core-backend/src/main/java/io/dataease/datasource/type/Mysql.java. The...
CVE-2023-51702 Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service
Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an...
PT-2024-14253
Name of the Vulnerable Software and Affected Versions Airflow versions 5.2.0 through 6.x Airflow versions 2.3.0 through 2.6.0 Description The Airflow worker serializes a Kubernetes configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption wh...
PT-2024-14943 · WordPress · Debug Log Manager
Name of the Vulnerable Software and Affected Versions: Debug Log Manager WordPress plugin versions prior to 2.3.0 Description: A Directory listing issue was discovered, allowing unauthorized access to download the debug log and potentially gain access to sensitive data. Recommendations: For...
WordPress Plugin Debug Log Manager Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
WordPress WooCommerce Warranty Requests Plugin <= 2.2.7 is vulnerable to Broken Access Control
Software WooCommerce Warranty Requests Type Plugin Vulnerable versions = 2.2.7 Fixed in 2.3.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51495 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 718f302faa3f Credits Rafie Muhammad...
CVE-2023-40716
An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the command line interpreter of FortiTester 2.3.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments when running execute restore/backup...
Design/Logic Flaw
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. In version 2.3.0-beta2 and prior, when h2o is configured to listen to multiple addresses or ports with each of them using different backend servers managed by multiple entities, a malicious backend entity that also has the...
WordPress Tutor LMS Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)
Software Tutor LMS Type Plugin Vulnerable versions = 2.2.4 Fixed in 2.3.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49829 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1f03fa341046 Credits emad Required privilege Administrator...
CVE-2023-6136
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.0...
CVE-2023-49733
Improper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue...
GHSA-8V4W-JR33-4RH3 Apache Cocoon SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue...
CVE-2022-45135
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue...
Sql injection
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue...
CVE-2022-45135 Apache Cocoon: SQL injection in DatabaseCookieAuthenticatorAction
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue...
PT-2023-32539 · Unknown · Bowo Debug Log Manager
Name of the Vulnerable Software and Affected Versions: Bowo Debug Log Manager versions through 2.3.0 Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This is a problem where sensitive data is made available to individuals who should not have...
PT-2023-31312 · Apache · Apache Cocoon
Name of the Vulnerable Software and Affected Versions: Apache Cocoon versions 2.2.0 through 2.2.x before 2.3.0 Apache Cocoon version 2.2.0 Description: The issue is related to an Improper Restriction of XML External Entity Reference, which allows users to inject malicious code into XML documents...
PT-2023-14616 · Apache · Apache Cocoon
Name of the Vulnerable Software and Affected Versions: Apache Cocoon versions 2.2.0 through 2.2.x before 2.3.0 Apache Cocoon versions prior to 2.3.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. Users...
PT-2023-30474 · WordPress · So Wp Pinyin Slugs
Name of the Vulnerable Software and Affected Versions: SO WP Pinyin Slugs plugin versions prior to 2.3.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For SO WP Pinyin Slugs plugin version...