CVE-2023-2476

CVE-2023-2476 affects Dromara J2eeFAST up to 2.6.0, specifically the Announcement Handler. The vulnerability arises from manipulating the argument 系统工具/公告管理, enabling remote cross-site scripting. Exploit appears to be publicly disclosed. Patch named 7a9e1a00e3329fdc0ae05f7a8257cce77037134d should...

J2eeFAST 跨站脚本漏洞

J2eeFAST is a Java EE enterprise-class rapid development platform , is committed to building the best small and medium-sized open source free backend framework platform . A cross-site scripting vulnerability exists in Dromara J2eeFAST version 2.6.0 and earlier versions. An attacker can exploit th...

WordPress Plugin WP Terms Popup 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress plugin Custom Permalinks 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

PT-2023-20955 · Netgate · Pfsense Ce +1

Name of the Vulnerable Software and Affected Versions: pfSense Plus software version 22.05.1 pfSense CE software version 2.6.0 Description: The issue is related to improper restriction of excessive authentication attempts in the SSHGuard component, allowing attackers to bypass brute force...

pfSense Restore RRD Data Command Injection

This module exploits an authenticated command injection vulnerabilty in the "restorerrddata" function of pfSense prior to version 2.7.0 which allows an authenticated attacker with the "WebCfg - Diagnostics: Backup & Restore" privilege to execute arbitrary operating system commands as the "root"...

OpenSearch has time discrepancy in authentication responses

Impact There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the internal basic identity provider IdP, and not other externally configured IdPs. Patches OpenSearch 1.3.9...

CVE-2023-25806 Time discrepancy in authentication responses in OpenSearch

OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the interna...

CVE-2022-29273

pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters...

PT-2023-12967 · Unknown · Pfsense Ce +1

Name of the Vulnerable Software and Affected Versions: pfSense CE versions 2.6.0 and earlier pfSense Plus versions prior to 22.05 Description: The issue allows for XSS in the WebGUI via URL Table Alias URL parameters. This means an attacker could potentially inject malicious scripts into the web...

pfSense CE 跨站脚本漏洞

pfSense is a set of network firewalls based on FreeBSD Linux. A security vulnerability exists in pfSense CE version 2.6.0 and earlier, and pfSense Plus version 22.05 and earlier. An attacker exploits the vulnerability to conduct cross-site scripting attacks in the WebGUI via URL parameters...

SUSE CVE-2004-0110

Buffer overflow in the 1 nanohttp or 2 nanoftp modules in XMLSoft Libxml 2 Libxml2 2.6.0 through 2.6.5 allow remote attackers to execute arbitrary code via a long URL...

SUSE CVE-2009-3025

Unspecified vulnerability in Pidgin 2.6.0 allows remote attackers to cause a denial of service crash via a link in a Yahoo IM...

SUSE CVE-2018-19625

In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the dissection engine could crash. This was addressed in epan/tvbuffcomposite.c by preventing a heap-based buffer over-read...

SUSE CVE-2021-37636

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of tf.rawops.SparseDenseCwiseDiv is vulnerable to a division by 0 error. The implementation uses a common class for all binary operations but fails to treat the division by 0 case...

SUSE CVE-2021-37666

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.RaggedTensorToVariant. The implementation has an incomplete validation of the splits values, missing the case...

SUSE CVE-2021-37664

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to BoostedTreesSparseCalculateBestFeatureSplit. The implementation needs to validate that...

SUSE CVE-2021-37669

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause denial of service in applications serving models using tf.rawops.NonMaxSuppressionV5 by triggering a division by 0. The implementation uses a user controlled argument to resize a...

SUSE CVE-2021-37672

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to tf.rawops.SdcaOptimizerV2. The implementation does not check that the length of...

SUSE CVE-2021-37678

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The implementation uses yaml.unsafeload which can perform arbitrary code execution...