Active Healthcare ELSI Smart Floor 安全漏洞

Active Healthcare ELSI Smart Floor is Active Healthcare's state-of-the-art smart flooring solution that reduces falls and improves safety in care environments. A security vulnerability exists in Active Healthcare ELSI Smart Floor version 3.3.3 that stems from the presence of a stored cross-site...

vantage6-node (>=3.3.3 <=3.7.3), vantage6-server (>=3.3.3 <=3.7.3) potentially affected by CVE-2022-39228 via vantage6 (>=3.3.3 <=3.7.3)

vantage6 PYPI version =3.3.3, =3.3.3, =3.3.3, =3.7.3 Source cves: CVE-2022-39228 Source advisory: OSV:PYSEC-2023-313...

vantage6-node (>=3.3.3 <=3.7.3), vantage6-server (>=3.3.3 <=3.7.3) potentially affected by CVE-2022-39228 via vantage6 (>=3.3.3 <=3.7.3)

vantage6 PYPI version =3.3.3, =3.3.3, =3.3.3, =3.7.3 Source cves: CVE-2022-39228 Source advisory: OSV:PYSEC-2023-52...

K77241314: Python vulnerability CVE-2013-7440

Security Advisory Description The ssl.matchhostname function in CPython aka Python before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate. CVE-2013-7440 Impact There is no impact; ...

SUSE CVE-2004-0691

Heap-based buffer overflow in the BMP image format parser for the QT library qt3 before 3.3.3 allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code...

SUSE CVE-2013-1839

The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service infinite loop and CPU consumption via a "," character in an Accept-Language header...

SUSE CVE-2017-15574

In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is possible by using an SVG document as an attachment...

PT-2023-10808 · Unknown · Joomgallery

Name of the Vulnerable Software and Affected Versions: JoomGallery versions up to 3.3.3 Description: A critical issue was found in JoomGallery, affecting an unknown part of the file administrator/components/com joomgallery/views/config/tmpl/default.php of the component Image Sort Handler. The...

GHSA-8R99-H8J2-RW64 Twisted vulnerable to HTTP Request Smuggling Attacks

Impact Twisted Web is vulnerable to request smuggling attacks: 1. "When presented with two content-length headers, Twisted Web ignored the first header. When the second content-length was set to zero this caused Twisted Web to interpret the request body as a pipelined request. According to RFC 72...

OESA-2022-1964 mod_security_crs security update

The base rules are provided for modsecurity by this package. Security Fixes: The OWASP ModSecurity Core Rule Set CRS is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indicates multiple character encoding schemes. A vulnerable back-end...

DEBIAN-CVE-2022-39957

The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web...

DEBIAN-CVE-2022-39956

The OWASP ModSecurity Core Rule Set CRS is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and...

UBUNTU-CVE-2022-39957

The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web...

XO Slider < 3.3.3 - Contributor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its Slider fields, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...

Algo 8028 Control Panel - Remote Code Execution (Authenticated) Exploit

Exploit Title: Algo 8028 Control Panel - Remote Code Execution RCE Authenticated Google Dork: intitle:"Algo 8028 Control Panel" Shodan: title:"Algo 8028 Control Panel" Exploit Author: Filip Carlsson Vendor Homepage: https://www.algosolutions.com/ Software Link:...

WordPress XO Slider plugin <= 3.3.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Ngo Van Thien Patchstack Alliance in WordPress XO Slider plugin versions = 3.3.2. Solution Update the WordPress XO Slider plugin to the latest available version at least 3.3.3...

Symfony Incorrect Access Control

Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The type of exploitation is: remote. The component is: Password validator...

CVE-2022-29599

In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks...

PT-2022-7347

Name of the Vulnerable Software and Affected Versions Apache Maven maven-shared-utils versions prior to 3.3.3 Description The issue is related to the Commandline class in Apache Maven maven-shared-utils, which can emit double-quoted strings without proper escaping. This allows for shell injection...

Python CGIHTTPServer 2.7.x < 2.7.8, 3.2.x < 3.2.5, 3.3.x < 3.3.3, 3.4.x < 3.4.2 Multiple Vulnerabilities (Jun 2014) - Linux

Python is prone to multiple vulnerabilities in CGIHTTPServer. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python";...