CVE-2022-0449

The Flexi WordPress plugin before 4.20 does not sanitise and escape various parameters before outputting them back in some pages such as the user dashboard, leading to a Reflected Cross-Site Scripting...

Fedora 37 : ckeditor (2022-4c634ee466)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-4c634ee466 advisory. CKEditor 4.20 New Features: 5084: Added the config.tabletoolsscopedHeaders configuration option controlling the behaviour of table headers with and...

CVE-2024-34510

Gradio before 4.20 allows credential leakage on Windows...

PYSEC-2024-255

Gradio before 4.20 allows credential leakage on Windows...

Gradio 安全漏洞

Gradio is an open source Python library that is a way to demonstrate machine learning models through a friendly web interface. A security vulnerability exists in Gradio versions prior to 4.20, which stems from allowing credential disclosure on Windows...

CVE-2024-34510

Gradio before 4.20 allows credential leakage on Windows...

CVE-2024-34510

Gradio before 4.20 allows credential leakage on Windows...

CVE-2020-23647

CVE-2020-23647 is a documented XSS vulnerability affecting BoxBilling versions 4.19, 4.19.1, 4.20, and 4.21. The issue arises from the message field on the “submit new ticket” form, allowing remote attackers to execute arbitrary code in some contexts. The available connected sources consistently ...

BoxBilling 跨站脚本漏洞

BoxBilling is open source billing and customer management software for BoxBilling individual developers. A cross-site scripting vulnerability exists in BoxBilling versions 4.19,4.19.1,4.20,4.21, which stems from arbitrary code that can be run via a form for submitting a new ticket. An attacker ca...

ZyXEL ZyWALL USG 操作系统命令注入漏洞

Zyxel ZyXEL ZyWALL USG is a network security firewall appliance from China Hopkins Zyxel. A security vulnerability exists in Zyxel ZyWALL/USG versions 4.20 to 4.72, VPN versions 4.30 to 5.32, USG FLEX versions 4.50 to 5.32, and ATP versions 4.32 to 5.32. The vulnerability stems from a...

CVE-2022-29619

Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.x - versions 420,430 allows user Administrator to view, edit or modify rights of objects it doesn't own and which would otherwise be restricted...

GSD-2022-1001867 udmabuf: validate ubuf->pagecount

udmabuf: validate ubuf-pagecount This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.33 by commit 811b667cefbea9cb7511a874b169d6a92907137e, it...

CVE-2022-0342

An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware...

Flexi - Guest Submit < 4.20 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape various parameters before outputting them back in some pages such as the user dashboard, leading to a Reflected Cross-Site Scripting PoC Open the following URL when authenticated as any user: https://example.com/user-dashboard/?search=keyword:...

WordPress Flexi – Guest Submit plugin <= 4.19 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Felipe Tapia Sasot in WordPress Flexi – Guest Submit plugin versions = 4.19. Solution Update the WordPress Flexi – Guest Submit plugin to the latest available version at least 4.20...

UVI-2021-1000493 uio_hv_generic: Fix another memory leak in error handling paths

uiohvgeneric: Fix another memory leak in error handling paths This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.7 by commit...

Security Advisory 0054

Security Advisory 0054 PDF Date: October 7th, 2020 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | October 7th, 2020 | Initial Release The CVE-ID tracking this issue is: CVE-2020-15897 CVSSv3.1 Base Score: 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description This advisory documen...

Nordaaker Convos Password Management Vulnerability

Nordaaker Convos is a Norwegian company Nordaaker's Web browser-based open source multi-user chat application . A security vulnerability exists in the Core/Settings.pm and Util.pm files in Nordaaker Convos versions prior to 4.20. The vulnerability stems from a poorly designed or implemented probl...

CVE-2020-14423

Convos before 4.20 does not properly generate a random secret in Core/Settings.pm and Util.pm. This leads to a predictable CONVOSLOCALSECRET value, affecting password resets and invitations...

NopCommerce 4.2.0 Privilege Escalation

Vulnerability Title: NopCommerce 4.2.0 - Privilege Escalation Author: Alessandro Magnosi d3adc0de Date: 2019-07-07 Vendor Homepage: https://www.nopcommerce.com/ Software Link : https://www.nopcommerce.com/ Tested Version: 4.2.0 Vulnerability Type: Privilege Escalation Tested on OS: Windows 10,...