NVS365 安全漏洞

NVS365 is a network video server from NVS365. A security vulnerability exists in NVS365 version V01, which stems from a command execution that can be triggered by the background network test function...

CVE-2022-47071

In NVS365 V01, the background network test function can trigger command execution...

PT-2023-15152 · Nvs365 · Nvs365

Name of the Vulnerable Software and Affected Versions: NVS365 version V01 Description: The background network test function in NVS365 can trigger command execution, potentially leading to unauthorized access or control. Recommendations: For NVS365 version V01, as a temporary workaround, consider...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Denial of Service via arbitrarily large Issue descriptions CSRF via file upload allows an attacker to take over a repository Sidekiq background job DoS by uploading malicious CI job artifact zips Sidekiq background job DoS by uploading a malicious Helm package...

PT-2025-49495

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.0.0-rc2 19 Description The Linux kernel contains an issue within the dm cache component. Specifically, the background tracker's queued work is not properly freed in the btracker destroy function. This can lead ...

CVE-2023-20916

In getMainActivityLaunchIntent of LauncherAppsService.java, there is a possible way to bypass the restrictions on starting activities from the background due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User...

Server side request forgery (ssrf)

An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery SSRF...

CVE-2022-44297

SiteServer CMS 7.1.3 has a SQL injection vulnerability the background...

CVE-2022-44297

SiteServer CMS 7.1.3 has a SQL injection vulnerability the background...

CVE-2022-46998

An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery SSRF...

CVE-2022-46998

An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery SSRF...

PT-2023-15126 · Taocms · Taocms

Name of the Vulnerable Software and Affected Versions: taocms version 3.0.2 Description: An issue in the website background of taocms allows attackers to execute a Server-Side Request Forgery SSRF. Recommendations: For taocms version 3.0.2, at the moment, there is no information about a newer...

CVE-2022-46998

CVE-2022-46998 affects taocms v3.0.2: a vulnerability in the website background enables Server-Side Request Forgery (SSRF). CVSS 3.1 base score 9.8 (NETWORK, LOW complexity, NONE user interaction, HIGH impact on Confidentiality/Integrity/Availability). Documented exploitation exists (POC) per one...

Spectra < 1.15.0 - Contributor+ Stored Cross-Side Scripting

The plugin does not sanitize user input as it reaches its style HTML attribute, allowing contributors to conduct stored XSS attacks via the plugin's Gutenberg blocks. Note: The exploit requires the Contact Form 7 plugin. Exploit Additional CSS classes for “Contact Form 7 Styler” Gutenberg block: ...

PT-2023-17706 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-12 through Android-12L Description: A possible way to bypass restrictions on starting activities from the background exists due to a missing permission check in the getMainActivityLaunchIntent function of...

CVE-2023-20916

In getMainActivityLaunchIntent of LauncherAppsService.java, there is a possible way to bypass the restrictions on starting activities from the background due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User...

Happyforms < 1.22.0 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Exploit Additional CSS classes for "Forms" Gutenberg...

Remote Code Execution

rxvt-unicode is vulnerable to remote code execution. The package is vulnerable to a remote code execution via the Perl background extension when an attacker is able to control the data written to the user's terminal and certain options are set...

Slackware Linux 15.0 / current rxvt-unicode Vulnerability (SSA:2023-003-02)

The version of rxvt-unicode installed on the remote host is prior to 9.26. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-003-02 advisory. - The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can contr...

Word Balloon < 4.19.3 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Exploit...