Ghost unauthorized newsletter modification vulnerability

Talos Vulnerability Report TALOS-2022-1624 Ghost unauthorized newsletter modification vulnerability December 21, 2022 CVE Number CVE-2022-41654 SUMMARY An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted...

Cross-site Scripting (XSS)

rails-html-sanitizer is vulnerable to cross site scripting. The vulnerability is due to the allowedtags function of sanitizer.rb which enables an attacker to inject content if the application developer has overridden the sanitizer's allowed tags...

Rails 跨站脚本漏洞

Rails is a Ruby-based open source web application framework from the Rails team. A cross-site scripting vulnerability exists in Rails rails-html-sanitizer versions prior to 1.4.4, which stems from a possible XSS vulnerability in certain configurations of Rails::Html::Sanitizer, where...

@agentlab/ldkg-ui-basetable (0.1.1), @agentlab/ldkg-ui-charts (>=0.1.2, <=0.1.7) +131 more potentially affected by CVE-2022-23494 via tinymce (>=5.0.6, <=5.10.5)

tinymce NPM version =5.0.6, =0.1.2, =0.3.7, =0.1.7, =0.1.6, =0.0.1, =9.0.0-alpha.5, =0.1.2, =0.8.4, =0.5.2, =10.3.1-snapshot-1616513687673, =1.68.82, =0.65.0, =0.18.0, =0.0.1, =0.0.7 and more Source cves: CVE-2022-23494 Source advisory: OSV:GHSA-GG8R-XJWQ-4W92...

WordPress Quiz and Survey Master plugin input validation error vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation error...

PT-2022-25351 · WordPress · Quiz/Survey Master

Name of the Vulnerable Software and Affected Versions: Quiz and Survey Master plugin for WordPress versions up to, and including, 8.0.4 Description: The issue is related to input validation bypass via the questionid parameter. Insufficient input validation allows attackers to inject content other...

WordPress plugin Quiz and Survey Master 输入验证错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation error...

rubygem-rails-html-sanitizer: possible xss with certain configurations

A Cross-site scripting XSS vulnerability exists in ruby on rails. This issue could allow an attacker to inject content into the application, leading to loss of integrity and confidentiality...

golang: net: lookup functions may return invalid host names

A flaw was found in Go. The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions in the net package and methods on the Resolver type, may return arbitrary values retrieved from DNS, allowing injection of unexpected contents. The highest threat from this vulnerability is to integri...

CVE-2022-37426

Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection...

CVE-2022-37426

Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection...

CVE-2022-37426

Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection...

CVE-2022-37426

Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection...

Unrestricted file upload

Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection...

CVE-2022-37426

Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection...

UBUNTU-CVE-2022-37426

Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection...

CVE-2022-37426

Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection...

CVE-2022-37426

Technical details (affected components, versions, root cause, and fixes) are not publicly provided in the supplied connected documents. Monitor for updates from vendors and security bulletins.

OpenNebula 代码问题漏洞

OpenNebula is an OpenNebula open source cloud computing platform for managing heterogeneous distributed data center infrastructures. A security vulnerability exists in OpenNebula that stems from the presence of an unlimited upload of dangerous types of files vulnerability that allows file content...

CVE-2022-37426: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection...