GHSA-2G4C-8FPM-C46V web3-utils Prototype Pollution vulnerability

Impact: The mergeDeep function in the web3-utils package has been identified for Prototype Pollution vulnerability. An attacker has the ability to modify an object's prototype, which could result in changing the behavior of all objects that inherit from the impacted prototype by providing careful...

CVE-2024-21505

CVE-2024-21505 affects the web3-utils package: versions prior to 4.2.1 are vulnerable to a Prototype Pollution issue in the recursive merge via the helper functions format and mergeDeep . An attacker can alter an object’s prototype, potentially changing behavior of all objects inheriting from it....

CVE-2021-47114

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix data corruption by fallocate When fallocate punches holes out of inode size, if original isize is in the middle of last cluster, then the part from isize to the end of the cluster will be zeroed with buffer write, at...

BIT-REDMINE-2021-31863

Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows Redmine users to read arbitrary local files accessible by the application server process...

Cross site scripting

Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting XSS vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute...

Flask-AppBuilder Cross-Site Scripting Vulnerability

Flask-AppBuilder is a simple and fast application development framework. A security vulnerability exists in Flask-AppBuilder versions prior to 4.1.4 through 4.2.1, which stems from a cross-site scripting XSS vulnerability in the OAuth login page...

Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)

A Cross-Site Scripting XSS vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user's browser. Impacted...

Withdrawn Advisory: Subrion CMS vulnerable to SQL Injection

Withdrawn Advisory This advisory has been withdrawn because it was determined to not be a vulnerability. Please see the issue here for more information. Original Description Subrion CMS 4.2.1 is vulnerable to SQL Injection via ia.core.mysqli.php...

GHSA-XXF8-FPMR-FW7V Withdrawn Advisory: Subrion CMS vulnerable to SQL Injection

Withdrawn Advisory This advisory has been withdrawn because it was determined to not be a vulnerability. Please see the issue here for more information. Original Description Subrion CMS 4.2.1 is vulnerable to SQL Injection via ia.core.mysqli.php...

CVE-2024-25399

Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting XSS via adminer.php...

Cross site scripting

Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting XSS via adminer.php...

PT-2024-20922 · Unknown · Subrion Cms

Name of the Vulnerable Software and Affected Versions: Subrion CMS version 4.2.1 Description: The issue is related to Cross Site Scripting XSS via the adminer.php file. This allows for potential malicious script injection. Recommendations: For Subrion CMS version 4.2.1, update to a version that...

Subrion CMS Security Vulnerability

Subrion CMS is a PHP-based content management system CMS from the Subrion team. The system can be integrated into websites and supports a variety of extensions plug-ins and more. A security vulnerability exists in Subrion CMS version 4.2.1, which stems from a cross-site scripting XSS vulnerabilit...

CVE-2024-25399

Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php. The underlying issue is inadequate input sanitization in the adminer.php script, enabling injection of malicious scripts that could be rendered in pages viewed by other users. No exploitation details are provided in th...

auth-token-django (>=0.0.1 <=0.0.5), bfactory (>=0.4.0 <=0.4.4) +45 more potentially affected by CVE-2024-24680 via django (>=4.2.0 <=4.2.1)

django PYPI version =4.2.0, =0.0.1, =0.4.0, =5.2.0, =3.1.0, =7.2.2, =39.1.0, =9.3.0, =0.1.0a1, =1.0.0, =1.1.0 - django-descope =1.0.0 and more Source cves: CVE-2024-24680 Source advisory: OSV:GHSA-XXJ9-F6RV-M3X4...

AZL-34807 CVE-2023-51257 affecting package jasper for versions less than 4.2.1-1

An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and before allows a local attacker to execute arbitrary code...

WordPress Essential Blocks for Gutenberg Plugin <= 4.2.0 is vulnerable to Broken Access Control

Software Essential Blocks for Gutenberg Type Plugin Vulnerable versions = 4.2.0 Fixed in 4.2.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51360 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID aa89b26b64fb Credits Rafie Muhamm...

CVE-2023-48625

CVE-2023-48625 affects Adobe Substance 3D Sampler

CVE-2023-48630 Adobe Substance 3D Sampler v4.2.1Build3527 OOBW Vulnerability I

Adobe Substance 3D Sampler versions 4.2.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

PT-2023-8546 · Adobe · Substance3D - Sampler

Name of the Vulnerable Software and Affected Versions: Adobe Substance 3D Sampler versions 4.2.1 and earlier Description: The issue is related to an out-of-bounds write vulnerability in memory. Exploitation of this issue could allow an attacker to execute arbitrary code with the help of a special...