GHSA-3657-Q433-MMPX Canvs Canvas Cross-site Scripting (XSS) via title and content fields

cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts Add New" action, and during creation of new tags and users...

Apache OpenMeetings vulnerable to SQL injection

Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end. The issue is fixed in version 3.3.0...

Apache OpenMeetings vulnerable to Cross-Site Request Forgery

Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery CSRF attacks, XSS attacks, click-jacking, and MIME based attacks. The issue is fixed in version 3.3.0...

Apache OpenMeetings displays Tomcat version and detailed error stack trace

Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure. The issue is fixed in version 3.3.0...

Apache OpenMeetings Cross-site Scripting vulnerability

Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0. The issue is fixed in version 3.3.0...

GHSA-67Q3-GWWW-PM4G Apache OpenMeetings does not correctly validate uploaded XML documents

Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0. The issue is fixed in version 3.3.0...

GHSA-4V67-WG88-37P9 Apache OpenMeetings displays Tomcat version and detailed error stack trace

Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure. The issue is fixed in version 3.3.0...

GHSA-M5PM-RGVF-VG22 Apache OpenMeetings vulnerable to Cross-Site Request Forgery

Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery CSRF attacks, XSS attacks, click-jacking, and MIME based attacks. The issue is fixed in version 3.3.0...

GHSA-XHJ7-JR45-5W8R Apache OpenMeetings updates user password in insecure manner

Apache OpenMeetings 1.0.0 updates user password in insecure manner. This issue is fixed in version 3.3.0...

org.cloudfoundry.identity:cloudfoundry-identity-api (>=3.0.0 <=3.20.0), org.cloudfoundry.identity:cloudfoundry-identity-app (>=3.0.0 <=3.20.0) +1 more potentially affected by CVE-2016-3084 via org.cloudfoundry.identity:cloudfoundry-identity-server (>=3.0.0 <=3.3.0)

org.cloudfoundry.identity:cloudfoundry-identity-server MAVEN version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.20.0 Source cves: CVE-2016-3084 Source advisory: OSV:GHSA-FM5C-2RWC-887W...

Tenda HG6 3.3.0 Remote Command Injection

Tenda HG6 v3.3.0 Remote Command Injection Vulnerability Vendor: Tenda Technology Co.,Ltd. Product web page: https://www.tendacn.com https://www.tendacn.com/product/HG6.html Affected version: Firmware version: 3.3.0-210926 Software version: v1.1.0 Hardware Version: v1.0 Check Version:...

Mageia: Security Advisory (MGASA-2022-0137)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross-site Scripting in TastyIgniter

TastyIgniter prior to version 3.3.0 is vulnerable to Document Object Model DOM based Cross-site Scripting XSS...

GHSA-CJW5-F2X5-R4Q5 Cross-site Scripting in TastyIgniter

TastyIgniter prior to version 3.3.0 is vulnerable to Document Object Model DOM based Cross-site Scripting XSS...

CVE-2022-0602

Cross-site Scripting XSS - DOM in GitHub repository tastyigniter/tastyigniter prior to 3.3.0...

CVE-2022-0602 Cross-site Scripting (XSS) - DOM in tastyigniter/tastyigniter

Cross-site Scripting XSS - DOM in GitHub repository tastyigniter/tastyigniter prior to 3.3.0...

TastyIgniter 跨站脚本漏洞

TastyIgniter is a free and open source online ordering software based on the Laravel PHP Framework designed for developers and restaurateurs to enjoy life. A cross-site scripting vulnerability previously existed in TastyIgniter 3.3.0. No information about this vulnerability is available at this...

PT-2022-13503 · WordPress · Ninja Forms - File Uploads Extension

Name of the Vulnerable Software and Affected Versions: Ninja Forms - File Uploads Extension WordPress plugin versions up to and including 3.3.0 Description: The issue is related to insufficient input file type validation found in the /includes/ajax/controllers/uploads.php file, which can be...

CVE-2022-24433

The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetchremote, branch, handlerFn function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary...

PT-2022-16694 · Unknown · Simple-Git

Name of the Vulnerable Software and Affected Versions: simple-git versions prior to 3.3.0 Description: The issue allows for Command Injection via argument injection. When calling the fetch function with parameters remote, branch, and handlerFn, both the remote and branch parameters are passed to...