PT-2024-23301 · Mesonlsp · Mesonlsp

Name of the Vulnerable Software and Affected Versions: MesonLSP versions prior to 4.1.4 Description: A vulnerability in MesonLSP allows overwriting arbitrary files if an attacker can make the victim run the language server within a specific crafted project or execute mesonlsp --full...

MesonLSP 安全漏洞

MesonLSP is an unofficial, unapproved language server for JCWasmx86 individual developers of mesons written in C++. A security vulnerability exists in MesonLSP versions prior to 4.1.4 that stems from the presence of a directory traversal vulnerability. An attacker can exploit this vulnerability t...

Flask-AppBuilder Cross-Site Scripting Vulnerability

Flask-AppBuilder is a simple and fast application development framework. A security vulnerability exists in Flask-AppBuilder versions prior to 4.1.4 through 4.2.1, which stems from a cross-site scripting XSS vulnerability in the OAuth login page...

Information disclosure

In Splunk Add-on Builder versions below 4.1.4, the app writes sensitive information to internal log files...

Splunk Security Breach

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

CVE-2023-6737

The Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SHORTPIXELDEBUG parameter in all versions up to, and including, 4.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

[SECURITY] Fedora 38 Update: openmpi-4.1.4-9.fc38

Open MPI is an open source, freely available implementation of both the MPI-1 and MPI-2 standards, combining technologies and resources from several other projects FT-MPI, LA-MPI, LAM/MPI, and PACX-MPI in order to build the best MPI library available. A completely new MPI-2 compliant...

Clip Share 4.1.4 Cross Site Scripting

==================================================================================================================================== | Title : Clip Share 4.1.4 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 66.0.264-bit | | Vendor :...

WordPress GravityStripe Subscription Manager Plugin <= 4.1.4 is vulnerable to Cross Site Scripting (XSS)

Software GravityStripe Subscription Manager Type Plugin Vulnerable versions = 4.1.4 Fixed in 4.1.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 757ed2a2a571 Credits Rafie Muhamma...

Moodle XSS Vulnerability (MSA-23-0016)

Moodle is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle";...

PT-2023-19818 · WordPress · Active Directory Integration

Name of the Vulnerable Software and Affected Versions: Active Directory Integration plugin for WordPress versions up to and including 4.1.4 Description: The issue allows for time-based SQL Injection due to insufficient escaping on the user-supplied orderby and order parameters and lack of...

TouchDown Timesheet Tracking for Jira 跨站脚本漏洞

TouchDown Timesheet Tracking for Jira is an easy-to-use timesheet reporting component from TouchDown, Switzerland. A security vulnerability exists in TouchDown Timesheet Tracking for Jira version 4.1.4, which stems from a stored cross-site scripting XSS vulnerability in the calendar view...

Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views

Impact A stored cross-site scripting XSS vulnerability exists on ModelAdmin views within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft pages and documents that, when viewed by a user with higher privileges, could perform...

CVE-2023-28837 Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files

Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a memory exhaustion bug exists in Wagtail's handling of uploaded images and documents. For both images and documents, files are loaded into memory during upload for additional processing. A use...

Wagtail 跨站脚本漏洞

Torchbox Wagtail is an open source content management system CMS from Torchbox UK. A cross-site scripting vulnerability exists in Wagtail versions 1.5 through 4.1.4, 4.2, and 4.2.1, which originates from a user who creates pages and documents, and then a user with elevated privileges can perform...

CVE-2021-4325

A vulnerability, which was classified as problematic, has been found in NHN TOAST UI Chart 4.1.4. This issue affects some unknown processing of the component Legend Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 4.2.0 is able to...

PT-2023-12421 · Nhn · Nhn Toast Ui Chart

Name of the Vulnerable Software and Affected Versions: NHN TOAST UI Chart version 4.1.4 Description: This issue affects some unknown processing of the component Legend Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. Recommendations: For NHN TOAST UI...

tui.chart 跨站脚本漏洞

tui.chart is an NHN open source beautiful chart for data visualization. A cross-site scripting vulnerability exists in version 4.1.4 of tui.chart, which stems from a problem with some unknown handling of the component Legend Handler that can lead to a cross-site scripting vulnerability...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF vulnerability in baijiacms 4.1.4, allows attackers to change the password or other information of an arbitrary account via index.php...

SUSE CVE-2019-3806

An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua...