SUSE CVE-2009-2715

Sun VirtualBox 2.2 through 3.0.2 r49928 allows guest OS users to cause a denial of service Linux host OS reboot via a sysenter instruction...

SUSE CVE-2015-4335

Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command...

PT-2023-15544 · Taocms · Taocms

Name of the Vulnerable Software and Affected Versions: taocms version 3.0.2 Description: The issue allows attackers to execute arbitrary code via a crafted PHP file. This is exploited through manipulation of the upext variable at the "/include/Model/Upload.php" endpoint. Recommendations: For taoc...

taoCMS 代码问题漏洞

taocms is a Chinese micro CMS Content Management System. A security vulnerability exists in version v3.0.2 of taocms, which stems from the background of its website allowing attackers to implement server-side request forgery...

This Week in Spring - SpringOne Essentials 2023 edition - January 24th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! Today is a very day for you see, today we kick off SpringOne Essentials, the online incarnation of SpringOne, online. Well see you live, on stream, in just a few hours!. SpringOne Essentials is going to be amazing, but before...

This Week in Spring - SpringOne Essentials 2023 edition - January 24th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! Today is a very day for you see, today we kick off SpringOne Essentials, the online incarnation of SpringOne, online. We'll see you live, on stream, in just a few hours!. SpringOne Essentials is going to be amazing, but befor...

PT-2023-19618 · Jenkins · Jenkins Bearychat Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins BearyChat Plugin versions 3.0.2 and earlier Description: A cross-site request forgery CSRF issue allows attackers to connect to an attacker-specified URL. Recommendations: For Jenkins BearyChat Plugin versions 3.0.2 and earlier, updat...

Cross site scripting

SalonERP version 3.0.2 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the page parameter against XSS attacks...

PT-2022-24942 · Unknown · @Keystone-6/Core

Name of the Vulnerable Software and Affected Versions: @keystone-6/core versions 3.0.0 through 3.0.1 Description: The issue arises when NODE ENV is inlined to "development" for user code, regardless of the environment variables. This affects users who use NODE ENV to trigger security-sensitive...

SalonERP 跨站脚本漏洞

SalonERP is a salon management software by Thomas Sparber, a personal developer. A security vulnerability exists in SalonERP version 3.0.2 that stems from not properly validating page parameters. An attacker could use this vulnerability to steal an arbitrary user's cookie...

PT-2022-26543 · Salonerp · Salonerp

Name of the Vulnerable Software and Affected Versions: SalonERP version 3.0.2 Description: The issue allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the page parameter against XSS attacks. Recommendations: Fo...

CVE-2022-42753

SalonERP 3.0.2 is vulnerable to an external attacker stealing arbitrary users’ cookies due to improper validation of the page parameter against XSS. The root cause is inadequate input validation that allows cookie theft through XSS-like manipulation. Impact is confidentiality (cookie leakage) wit...

Keystone 注入漏洞

Keystone is a powerful CMS designed to help you build and scale faster than any other Cms or application framework. A security vulnerability exists in Keystone versions prior to 3.0.2, which stems from the possibility of being inlined to user code if security-sensitive functionality is triggered...

CVE-2022-41474

RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily change the password of any account...

CVE-2022-41475

RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily add an administrator account...

RPCMS 跨站请求伪造漏洞

RPCMS is a software application. A website CMS system. A security vulnerability exists in RPCMS version v3.0.2, which stems from a vulnerability that allows an attacker to arbitrarily change the password of any account...

PT-2022-25880 · Rpcms · Rpcms

Name of the Vulnerable Software and Affected Versions: RPCMS version 3.0.2 Description: A reflected cross-site scripting XSS issue was found in the Search function. This could potentially allow an attacker to inject malicious scripts into the website. Recommendations: For RPCMS version 3.0.2,...

Apache Kafka vulnerability can lead to brokers hitting OutOfMemoryException, causing Denial of Service

A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Exampl...

CVE-2022-34917 Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers

A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Exampl...

cruddl vulnerable to ArangoDB Query Language (AQL) injection through flexSearch

Impact If a vunerable version of cruddl is used to generate a schema that uses @flexSearchFulltext, users of that schema may be able to inject arbitrary AQL queries that will be forwarded to and executed by ArangoDB. Schemas that do not use @flexSearchFulltext are not affected. The attacker needs...