CVE-2022-45086

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Group Arge Energy and Control Systems Smartpower Web allows Cross-Site Scripting XSS. This issue affects Smartpower Web: before 23.01.01...

bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute...

CVE-2022-32527

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted alarm cache data messages. Affected Products: IGSS Data Server - IGSSdataServer.exe...

DEBIAN-CVE-2023-0473

Type Confusion in ServiceWorker API in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

UBUNTU-CVE-2023-0473

Type Confusion in ServiceWorker API in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

WordPress plugin The Rate my Post 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

WordPress plugin The 10WebMapBuilder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress plugin The Mongoose Page Plugin 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

WordPress plugin The Structured Content 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PYSEC-2023-283

Cross-Site Request Forgery CSRF in GitHub repository modoboa/modoboa prior to 2.0.4...

NexusPHP 安全漏洞

NexusPHP is a free and open source complete PT site building solution. A security vulnerability exists in NexusPHP before 1.7.33, which is caused by a missing check executed on the /forums.php?action=post page...

pgAdmin 输入验证错误漏洞

pgAdmin is an open source administration and development platform for the open source database PostgreSQL. A security vulnerability exists in versions prior to pgAdmin 4 v6.14, which originates from when a specially crafted URL is accessed, the user may be redirected to an arbitrary website and t...

PT-2023-13945 · WordPress · Royal Elementor Addons

Name of the Vulnerable Software and Affected Versions: The Royal Elementor Addons WordPress plugin versions prior to 1.3.56 Description: The issue is related to the lack of authorization and CSRF checks when deleting a template, and it does not ensure that the post to be deleted is a template. Th...

Siren Investigate 安全漏洞

Siren Investigate is a front-end to the Siren platform from Siren Ireland, allowing the creation of dashboards, charts, link analysis, alerts and more. A security vulnerability exists in Siren Investigate versions prior to 12.1.7 that stems from the presence of ACL bypasses on global objects...

PT-2023-13793 · WordPress · Wp User

Name of the Vulnerable Software and Affected Versions: WP User WordPress plugin versions prior to 7.0 Description: The issue is related to a SQL injection that can be exploited by unauthenticated users due to improper sanitization and escaping of a parameter in a SQL statement. Recommendations: F...

memos 访问控制错误漏洞

memos is an open source hosted memo center with knowledge management and social features. An access control error vulnerability exists in versions of memos prior to 0.9.1, which can be exploited by an attacker to change any user's email and username, as well as display name...

DEBIAN-CVE-2022-46871

An out of date library libusrsctp contained vulnerabilities that could potentially be exploited. This vulnerability affects Firefox 108...

PT-2022-16022 · Unknown · Bigbluebutton

Name of the Vulnerable Software and Affected Versions: BigBlueButton versions prior to 2.4-rc-6 Description: The moderators-only webcams lock setting in BigBlueButton is not enforced on the backend. This allows an attacker to subscribe to viewers' webcams, even when the lock setting is applied, b...

DEBIAN-CVE-2022-4437

Use after free in Mojo IPC in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

UBUNTU-CVE-2022-3509

A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes...