CVE-2024-28180 Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

CVE-2024-28180

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

PT-2024-2050

Name of the Vulnerable Software and Affected Versions go-jose versions prior to 2.6.3 go-jose versions prior to 3.0.3 go-jose versions prior to 4.0.1 Description The issue is related to the incorrect handling of highly compressed input data in the go-jose package, which implements the Javascript...

AZL-35472 CVE-2024-26455 affecting package fluent-bit for versions less than 3.0.3-1

fluent-bit 2.2.2 contains a Use-After-Free vulnerability in /fluent-bit/plugins/customcalyptia/calyptia.c...

santuario: Private Key disclosure in debug-log output

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to...

PT-2024-19992 · Sveltejs · @Sveltejs/Adapter-Node +1

Name of the Vulnerable Software and Affected Versions: @Sveltejs/adapter-node versions prior to 2.1.2, 3.0.3, and 4.0.1 @Sveltejs/kit versions prior to 2.4.3 Description: The issue occurs when sending a GET request with a body, for example , to a built and previewed/hosted SvelteKit app, which...

Apache Superset 跨站脚本漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A cross-site scripting vulnerability exists in Apache Superset versions prior to 3.0.3, which stems from the application's lack of effective filtering and escaping of user-supplied data, and can ...

CVE-2023-6893

A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.320201113RELEASEHIK and classified as problematic. Affected by this issue is some unknown functionality of the file /php/exportrecord.php. The manipulation of the argument downname with the input...

Hikvision Intercom Broadcasting System Path Traversal Vulnerability

Hikvision Intercom Broadcasting System is an intercom broadcasting system from Hikvision China. A path traversal vulnerability exists in Hikvision Intercom Broadcasting System version 3.0.320201113RELEASE HIK, which stems from a path traversal caused by the downname parameter in file...

PT-2023-32803 · Hikvision · Hikvision Intercom Broadcasting System

Name of the Vulnerable Software and Affected Versions: Hikvision Intercom Broadcasting System versions 3.0.3 20201113 RELEASEHIK through 3.0.3 20201113 RELEASEHIK Description: A vulnerability was found in the Hikvision Intercom Broadcasting System, affecting some unknown functionality of the file...

Hikvision Intercom Broadcasting System Information Disclosure Vulnerability

Hikvision Intercom Broadcasting System is an intercom broadcasting system from Hikvision China. An information disclosure vulnerability exists in Hikvision Intercom Broadcasting System version 3.0.320201113RELEASE HIK, which originates from the file access/html/system.html that can lead to...

PT-2023-32805

Name of the Vulnerable Software and Affected Versions Hikvision Intercom Broadcasting System versions 3.0.3 20201113 RELEASEHIK Description A critical issue exists in Hikvision Intercom Broadcasting System. The issue affects unknown code within the /php/ping.php file. Manipulating the jsondataip...

CVE-2023-28747

Cross-Site Request Forgery CSRF vulnerability in codeboxr CBX Currency Converter plugin = 3.0.3 versions...

CVE-2023-28747 WordPress CBX Currency Converter Plugin <= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in codeboxr CBX Currency Converter plugin = 3.0.3 versions...

ITOP Cross-Site Scripting Vulnerability

ITOP is a platform that provides all the resources needed to optimize iTop. A cross-site scripting vulnerability exists in ITOP version 3.0.3, which stems from a possible cross-site script injection on pages/UI.php...

ITOP Cross-Site Scripting Vulnerability

ITOP is a platform that provides all the resources needed to optimize iTop. A cross-site scripting vulnerability exists in ITOP version 3.0.3, which stems from a possible cross-site script injection on pages/preferences.php...

PT-2023-6589 · Apache +1 · Apache Santuario Xml Security For Java +1

Name of the Vulnerable Software and Affected Versions: Apache Santuario - XML Security for Java versions prior to 2.2.6 Apache Santuario - XML Security for Java versions prior to 2.3.4 Apache Santuario - XML Security for Java versions prior to 3.0.3 Description: The issue is related to the...

CVE-2023-37998

Cross-Site Request Forgery CSRF vulnerability in Saas Disabler allows Cross Site Request Forgery.This issue affects Disabler: from n/a through 3.0.3...

CVE-2023-37998 WordPress Disabler Plugin <= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Saas Disabler allows Cross Site Request Forgery.This issue affects Disabler: from n/a through 3.0.3...

CVE-2023-37998 WordPress Disabler Plugin <= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Saas Disabler allows Cross Site Request Forgery.This issue affects Disabler: from n/a through 3.0.3...