Matrix Synapse DoS

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 263 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

CVE-2018-11564

creationtimestamp| type| source ---|---|--- 2022-05-14 03:14:51+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-3rwj-v7jp-w542 2024-04-25 22:03:01+00:00| published-proof-of-concept| https://t.me/arpsyndicate/4876...

angular-lunarc-blog (>=0.0.1, <=0.0.3), angular-lunarc-core (>=0.0.2, <=0.0.5) +15 more potentially affected by CVE-2018-11537 via angular-jwt (>=0.0.7, <=0.1.9)

angular-jwt NPM version =0.0.7, =0.0.1, =0.0.2, =0.0.1, =4.0.0, =1.0.0, =2.0.0, =4.0.0, =3.0.19, =3.1.0, =7.0.0, =3.0.0, =1.0.0-alpha.6, =0.2.4, =0.0.1, =0.5.0 and more Source cves: CVE-2018-11537 Source advisory: OSV:GHSA-VM2P-F5J4-MJ6G...

Angular Redactor XSS Vulnerability

Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035...

GHSA-88FH-8979-Q2RR Angular Redactor XSS Vulnerability

Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035...

GHSA-H755-H99P-9FFV XML External Entity Reference in weixin-java-tools

An issue was discovered in weixin-java-tools. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file. NOTE: this issue exists because of an incomplete fix for CVE-2018-20318...

XML External Entity Reference in weixin-java-tools

An issue was discovered in weixin-java-tools. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file. NOTE: this issue exists because of an incomplete fix for CVE-2018-20318...

Gogs Directory Traversal

In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925...

@alfresco/adf-content-services (>=2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, <=2.5.0-ffef7688d7d5b9a2827d4427d416d0b5b2f377d4), @alfresco/adf-core (>=2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, <=2.5.0-ffef7688d7d5b9a2827d4427d416d0b5b2f377d4) +200 more potentially affected by CVE-2018-5158 via pdfjs-dist (>=1.2.113, <=1.10.97)

pdfjs-dist NPM version =1.2.113, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =0.0.1, =1.0.0, =0.0.9, =0.1.5, =1.2.1, =1.0.34, =1.2.1-a, =1.0.0,...

@accoio/react-pdf-highlighter (>=2.0.0, <=2.0.1), @activelylearn/react-pdf (>=2.5.0, <=2.5.2) +97 more potentially affected by CVE-2018-5158 via pdfjs-dist (>=2.0.104, <=2.0.489)

pdfjs-dist NPM version =2.0.104, =2.0.0, =2.5.0, =1.0.32, =1.2.0, =15.0.0, =6.0.0, =39.0.0, =7.0.0, =110.0.0, =7.0.0, =6.0.0, =3.0.6, =8.0.0, =9.0.0, =4.0.9, =4.2.1 and more Source cves: CVE-2018-5158 Source advisory: OSV:GHSA-7JG2-JGV3-FMR4...

CentOS: Security Advisory for minizip (CESA-2022:2213)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

minizip, zlib security update

CentOS Errata and Security Advisory CESA-2022:2213 An update for zlib is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

CVE-2018-20253

creationtimestamp| type| source ---|---|--- 2022-05-13 14:50:57+00:00| seen| Telegram/HCGXoItEOSDGQS0XtSCX9ojSUbaqleau5557KYxLYhrO8Q 2024-03-30 06:03:17+00:00| published-proof-of-concept| https://t.me/CybNux/6061...

@aleen42/gitbook-cli (1.0.0), @amalto/checkboxes-input (1.0.16) +116 more potentially affected by CVE-2018-7408 via npm (>=5.0.2, <=5.6.0)

npm NPM version =5.0.2, =5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on npm and may be impacted: - @aleen42/gitbook-cli 1.0.0 - @amalto/checkboxes-input 1.0.16 - @amalto/code-editor 1.1.48 - @amalto/cron-input 1.0.8 - @amalto/file-importer 1.0.1...

GHSA-F88Q-22G8-FRCG Cobbler Improper Validation of Security Tokens

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API /cobblerapi that can result in Privilege escalation, data manipulation or...

dltsign-mobile (0.1.0), jumper-form (>=1.0.91, <=1.2.95) +6 more potentially affected by CVE-2018-6464 via simditor (>=2.1.14, <=2.3.6)

simditor NPM version =2.1.14, =1.0.91, =0.0.1, =2.0.2, =1.0.1, =2.0.4, =2.0.7 - simditor-prettyemoji 1.0.0 Source cves: CVE-2018-6464 Source advisory: OSV:GHSA-P9WJ-WRRM-84M5...

GHSA-W9RV-WWXR-VC3Q ChakraCore RCE Vulnerability

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8617,...

GHSA-3HQW-MG9X-R2VR ChakraCore RCE Vulnerability

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8503, CVE-2018-8505,...

GHSA-VJF9-8WQG-XC7R ChakraCore RCE Vulnerability

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8503, CVE-2018-8505,...

ChakraCore RCE Vulnerability

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8367, CVE-2018-8466,...