Rocky Linux 8 : ruby:2.5 (RLSA-2019:1972)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2019:1972 advisory. - An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could...

PT-2023-32249 · WordPress · Accordion

Name of the Vulnerable Software and Affected Versions: Accordion plugin for WordPress versions up to, and including, 2.6 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'tcpaccordion' shortcode due to insufficient input sanitization and output escaping on...

PT-2023-17692 · Harbor · Harbor

Name of the Vulnerable Software and Affected Versions: Harbor versions 2.6.x and earlier Harbor versions 2.7.2 and earlier Harbor versions 2.8.2 and earlier Harbor versions 1.10.17 and earlier Description: A timing condition in Harbor allows an attacker with network access to create jobs, stop jo...

CVE-2023-5029

A vulnerability, which was classified as critical, was found in mccms 2.6. This affects an unknown part of the file /category/order/hits/copyright/46/finish/1/list/1. The manipulation with the input '"1 leads to sql injection. The exploit has been disclosed to the public and may be used. The...

Sql injection

A vulnerability, which was classified as critical, was found in mccms 2.6. This affects an unknown part of the file /category/order/hits/copyright/46/finish/1/list/1. The manipulation with the input '"1 leads to sql injection. The exploit has been disclosed to the public and may be used. The...

CVE-2023-5029 mccms 1 sql injection

A vulnerability, which was classified as critical, was found in mccms 2.6. This affects an unknown part of the file /category/order/hits/copyright/46/finish/1/list/1. The manipulation with the input '"1 leads to sql injection. The exploit has been disclosed to the public and may be used. The...

CVE-2023-5029 mccms 1 sql injection

A vulnerability, which was classified as critical, was found in mccms 2.6. This affects an unknown part of the file /category/order/hits/copyright/46/finish/1/list/1. The manipulation with the input '"1 leads to sql injection. The exploit has been disclosed to the public and may be used. The...

CVE-2023-5029

CVE-2023-5029 affects mccms 2.6, specifically the file path /category/order/hits/copyright/46/finish/1/list/1. The issue is a SQL injection vulnerability exploitable by manipulating input, e.g., "1". The vulnerability has been disclosed publicly (VDB-239871) and is described as critical/high impa...

CVE-2023-41009

File Upload vulnerability in adlered bolo-solo v.2.6 allows a remote attacker to execute arbitrary code via a crafted script to the authorization field in the header...

WordPress Rescue Shortcodes Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

Software Rescue Shortcodes Type Plugin Vulnerable versions = 2.5 Fixed in 2.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-41728 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e35ae9ed3dd7 Credits yuyudhn Required privileg...

PT-2023-27740 · Unknown · Adlered Bolo-Solo

Name of the Vulnerable Software and Affected Versions: adlered bolo-solo version 2.6 Description: The issue allows a remote attacker to execute arbitrary code via a crafted script to the authorization field in the header. This can be done by uploading a file with malicious content, potentially...

SUSE CVE-2020-35357

A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL GNU Scientific Library, versions 2.5 and 2.6. Processing a maliciously crafted input data for gslstatsquantilefromsorteddata of the library may lead to unexpected application termination or arbitra...

Ubuntu 20.04 LTS : HAProxy vulnerability (USN-6294-2)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6294-2 advisory. USN-6294-1 fixed vulnerabilities in HAProxy. This update provides the corresponding updates for Ubuntu 20.04 LTS. Tenable has extracted the preceding description...

AlmaLinux 8 : ruby:2.6 (ALSA-2021:2588)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:2588 advisory. rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code CVE-2019-3881 ruby: NUL injection vulnerability of...

CVE-2022-24834 Heap overflow issue with the Lua cjson library used by Redis

Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support,...

XWiki Platform 跨站脚本漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the XWiki Foundation in France. A security vulnerability exists in XWiki Platform. An attacker could use this vulnerability to inject Javascript code into a page by forging a URL and trigger a cross-site...

PT-2023-9377 · Duktape +4 · Duktape +4

Name of the Vulnerable Software and Affected Versions: Zabbix versions affected versions not specified Duktape version 2.6 Description: The issue is related to an unverified array indexing in the Duktape component of the Zabbix monitoring system. This can lead to a denial of service when exploite...

Cross site scripting

A vulnerability, which was classified as problematic, was found in BeipyVideoResolution up to 2.6. Affected is an unknown function of the file admin/admincore.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the...

BeipyVideoResolution 跨站脚本漏洞

BeipyVideoResolution is an open source video playback framework from the individual developers of Beipy in China. A cross-site scripting vulnerability exists in BeipyVideoResolution version 2.6 and earlier versions. Attackers can exploit this vulnerability to execute cross-site scripting attacks...

PT-2023-22553 · Unknown · Beipyvideoresolution

Name of the Vulnerable Software and Affected Versions: BeipyVideoResolution versions up to 2.6 Description: A problematic vulnerability was found in BeipyVideoResolution, affecting an unknown function of the file admin/admincore.php. The manipulation leads to cross site scripting and can be...