CVE-2023-48709

iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas that may be imported into Excel. As Excel 2016 does not prevent Remote Code Execution by default, uninformed users may become victims. This...

CVE-2023-48709

CVE-2023-48709 – iTop formula/CSV export vulnerability : Combodo iTop exports data to CSV/Excel; inputs in exported files may contain malicious formulas. If opened in Excel, this could lead to remote code execution (noted for Excel 2016). Affected versions are iTop prior to the fixed releases. Re...

CVE-2023-48709 iTop vulnerable to potential formula injection in Excel/CSV export file

iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas that may be imported into Excel. As Excel 2016 does not prevent Remote Code Execution by default, uninformed users may become victims. This...

CVE-2023-48709 iTop vulnerable to potential formula injection in Excel/CSV export file

iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas that may be imported into Excel. As Excel 2016 does not prevent Remote Code Execution by default, uninformed users may become victims. This...

PT-2024-12302 · Rancher · Rancher

Name of the Vulnerable Software and Affected Versions: Rancher versions 2.6.0 through 2.6.13 Rancher versions 2.7.0 through 2.7.9 Rancher versions 2.8.0 through 2.8.1 Description: A vulnerability has been identified when granting a create or global role for a resource type of "namespaces". This c...

PT-2024-13389 · Unknown · Rm Bookingcalendar Module +1

Name of the Vulnerable Software and Affected Versions: PrestaShop versions 2.7.9 and before Description: The issue allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the ics export.php file. This is a result of a SQL Injection vulnerabilit...

CVE-2023-49833

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force Spectra – WordPress Gutenberg Blocks allows Stored XSS.This issue affects Spectra – WordPress Gutenberg Blocks: from n/a through 2.7.9...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.7.9 security and bug fix updates

Red Hat Advanced Cluster Management for Kubernetes 2.7.9 General Availability release images, which provide security updates and fix bugs. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

WordPress Schema Pro Plugin <= 2.7.8 is vulnerable to Broken Access Control

Software Schema Pro Type Plugin Vulnerable versions = 2.7.8 Fixed in 2.7.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-36683 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 77fd92d9030a Credits Rafie Muhammad Patchstack Required...

K77241314: Python vulnerability CVE-2013-7440

Security Advisory Description The ssl.matchhostname function in CPython aka Python before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate. CVE-2013-7440 Impact There is no impact; ...

SUSE CVE-2004-0096

Unknown vulnerability in modpython 2.7.9 allows remote attackers to cause a denial of service httpd crash via a certain query string, a variant of CAN-2003-0973...

@chrismou/ember-cli-fullpage-js (>=1.0.0 <=1.0.4), @fullpage/angular-fullpage (>=0.0.1 <=0.1.9) +34 more potentially affected by CVE-2022-1330 via fullpage.js (>=2.7.9 <=4.0.41)

fullpage.js NPM version =2.7.9, =1.0.0, =0.0.1, =0.2.3, =0.0.1, =1.0.1, =0.0.14, =1.0.15, =0.2.1, =1.0.0, =1.0.7, =0.1.16, =0.1.18 - gatsby-theme-wild-child =1.2.10 - invertmode =1.0.0 and more Source cves: CVE-2022-1330 Source advisory: OSV:GHSA-H3CQ-J957-VHXG...

@chrismou/ember-cli-fullpage-js (>=1.0.0 <=1.0.4), @fullpage/angular-fullpage (>=0.0.1 <=0.0.16) +28 more potentially affected by CVE-2022-1295 via fullpage.js (>=2.7.9 <=3.1.2)

fullpage.js NPM version =2.7.9, =1.0.0, =0.0.1, =0.0.1, =1.0.1, =0.0.14, =1.0.15, =0.2.1, =1.0.0, =1.0.7, =0.1.16, =1.0.0, =1.0.0, =1.0.2 and more Source cves: CVE-2022-1295 Source advisory: OSV:GHSA-VPGW-FFH3-648H...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress SportsPress plugin has a cross-site scripting vulnerability in versions prior to 2.7.9, which...

Python < 2.7.9, 3.4.x < 3.4.3 Validate TLS certificate (bpo-22417) - Linux

Python is prone to a man-in-the-middle vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python"; ifdescripti...

Discourse < 2.7.9 RCE Vulnerability

Discourse is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2021-23140 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions 2.7.8 and earlier Description: Discourse is an open source platform for community discussion. In affected versions, maliciously crafted requests could lead to remote code execution. This resulted from a lack of validation i...

Cross site request forgery (csrf)

Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary...

Apache Dubbo代码问题漏洞

Apache Dubbo is the United States Apache Apache Foundation of a lightweight Java-based RPC Remote Procedure Call framework. The product provides interface-based remote calling , fault tolerance and load balancing and automatic service registration and discovery. A deserialization vulnerability...

CVE-2020-24314

Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL...