CVE-2022-44297

SiteServer CMS 7.1.3 has a SQL injection vulnerability the background...

CVE-2022-44297

SiteServer CMS 7.1.3 has a SQL injection vulnerability the background...

CVE-2022-46998

An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery SSRF...

CVE-2022-46998

CVE-2022-46998 affects taocms v3.0.2: a vulnerability in the website background enables Server-Side Request Forgery (SSRF). CVSS 3.1 base score 9.8 (NETWORK, LOW complexity, NONE user interaction, HIGH impact on Confidentiality/Integrity/Availability). Documented exploitation exists (POC) per one...

CVE-2022-46998

An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery SSRF...

CVE-2022-46998

An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery SSRF...

CVE-2022-46998: Server-Side Request Forgery (SSRF)

An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery SSRF...

PT-2023-15126 · Taocms · Taocms

Name of the Vulnerable Software and Affected Versions: taocms version 3.0.2 Description: An issue in the website background of taocms allows attackers to execute a Server-Side Request Forgery SSRF. Recommendations: For taocms version 3.0.2, at the moment, there is no information about a newer...

CVE-2023-20916

In getMainActivityLaunchIntent of LauncherAppsService.java, there is a possible way to bypass the restrictions on starting activities from the background due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User...

PT-2023-17706 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-12 through Android-12L Description: A possible way to bypass restrictions on starting activities from the background exists due to a missing permission check in the getMainActivityLaunchIntent function of...

Spectra < 1.15.0 - Contributor+ Stored Cross-Side Scripting

The plugin does not sanitize user input as it reaches its style HTML attribute, allowing contributors to conduct stored XSS attacks via the plugin's Gutenberg blocks. Note: The exploit requires the Contact Form 7 plugin. Exploit Additional CSS classes for “Contact Form 7 Styler” Gutenberg block: ...

Happyforms < 1.22.0 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Exploit Additional CSS classes for "Forms" Gutenberg...

Remote Code Execution

rxvt-unicode is vulnerable to remote code execution. The package is vulnerable to a remote code execution via the Perl background extension when an attacker is able to control the data written to the user's terminal and certain options are set...

Slackware Linux 15.0 / current rxvt-unicode Vulnerability (SSA:2023-003-02)

The version of rxvt-unicode installed on the remote host is prior to 9.26. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-003-02 advisory. - The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can contr...

Word Balloon < 4.19.3 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Exploit...

EU Cookie Law <= 3.1.6 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Enter the setting page of this plugin. 2. In t...

CVE-2022-45407

If an attacker loaded a font using FontFace on a background worker, a use-after-free could have occurred, leading to a potentially exploitable crash. This vulnerability affects Firefox 107...

CVE-2022-29910

When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings.Note: This issue only affected Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox 100...

Design/Logic Flaw

If an attacker loaded a font using FontFace on a background worker, a use-after-free could have occurred, leading to a potentially exploitable crash. This vulnerability affects Firefox 107...

CVE-2022-45407: Use After Free

If an attacker loaded a font using FontFace on a background worker, a use-after-free could have occurred, leading to a potentially exploitable crash. This vulnerability affects Firefox 107...