CVE-2022-0726

Missing Authorization in GitHub repository chocobozzz/peertube prior to 4.1.0...

AlmaLinux 8 : virt:rhel (ALSA-2020:2774)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:2774 advisory. QEMU: Slirp: potential OOB access due to unsafe snprintf usages CVE-2020-8608 QEMU: vnc: memory leakage upon disconnect CVE-2019-20382 Tenable has extract...

cve-search has an unspecified vulnerability

Cve-Search is a tool that performs local searches for known vulnerabilities. It is used for searching, indexing, correlating and managing software vulnerabilities. cve-search versions prior to 4.1.0 have a security vulnerability that stems from lib/DatabaseLayer.py allowing regular expression...

WUZHI CMS Cross-Site Scripting Vulnerability (CNVD-2022-02733)

WUZHI CMS is a PHP and MySQL based open source content management system CMS from Wuzhi. version 4.1.0 of WUZHI CMS has a cross-site scripting vulnerability that can be exploited by attackers to steal cookies from administrators...

poi: a specially crafted Microsoft Excel document allows attacker to read files from the local filesystem

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity XXE Processing...

Design/Logic Flaw

eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to bypass a brute-force protection mechanism by using many different forged PHPSESSID values in HTTP Cookie header. This issue has been addressed by implementing...

GHSA-Q799-Q27X-VP7W Out-of-bounds Write in OpenCV

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, version 4.1.0 corresponds with OpenCV-Python version 4.1.2.30. A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code...

CVE-2021-41732

An issue was discovered in zeek version 4.1.0. There is a HTTP request splitting vulnerability that will invalidate any ZEEK HTTP based security analysis. NOTE: the vendor's position is that the observed behavior is intended...

CVE-2021-41732

CVE-2021-41732 affects Zeek 4.1.0 and is described as a HTTP request splitting vulnerability that will invalidate any Zeek HTTP-based security analysis. The observed behavior is noted by the vendor as intended in Zeek. The connected documents consistently reference Zeek 4.1.0 and the HTTP-splitti...

CVE-2021-41732

An issue was discovered in zeek version 4.1.0. There is a HTTP request splitting vulnerability that will invalidate any ZEEK HTTP based security analysis. NOTE: the vendor's position is that the observed behavior is intended...

WUZHI CMS SQL Injection Vulnerability (CNVD-2021-99282)

WUZHI CMS WUZHI CMS is a high-performance open source content management system , support for LNAMP architecture , suitable for portals , corporate Web site , mobile site , microblogging promotion. WUZHI CMS 4.1.0 version of the /coreframe/app/content/admin/content.php in the checktitle function...

Wuzhi CMS 代码注入漏洞

WUZHI CMS Five Fingers CMS is a high-performance open source content management system that supports LNAMP architecture, suitable for portals, enterprise websites, mobile sites, microsoft promotion. attachmentadminindex.php in WUZHI CMS version 4.1.0 has a remote code execution vulnerability. An...

Cross site scripting

Cross Site Scripting XSS vulnerability exists in WUZHI CMS 4.1.0 via the mailbox username in index.php...

CVE-2020-19915

Cross Site Scripting XSS vulnerability exists in WUZHI CMS 4.1.0 via the mailbox username in index.php...

CVE-2020-19915

The CVE-2020-19915 is a Cross-Site Scripting (XSS) vulnerability in WUZHI CMS 4.1.0, exploitable via the mailbox/email username parameter in index.php. Multiple connected sources corroborate the affected product/version and the input vector, describing remote XSS through that parameter. The docum...

Apache Jena XML External Entity Injection Vulnerability

Apache Jena is the United States Apache Apache Foundation of a Java Semantic Web framework. Used to build semantic Web and linked data applications. Apache Jena in versions prior to 4.1.0 there is an XML external entity injection vulnerability , the vulnerability stems from the network system or...

CVE-2021-40669

SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords parameter under the coreframe/app/promote/admin/index.php file...

CVE-2021-40670

SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords iparameter under the /coreframe/app/order/admin/card.php file...

CVE-2021-40670

SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords iparameter under the /coreframe/app/order/admin/card.php file...

CVE-2021-40670

CVE-2021-40670 affects Wuzhi CMS 4.1.0. A SQL injection flaw exists in the keywords parameter exposed via /coreframe/app/order/admin/card.php, enabling manipulation of database queries. Multiple sources confirm the vulnerability and describe it as a SQL injection in Wuzhi CMS 4.1.0. CVSS metrics ...