Cross Site Scripting(XSS)

intelliants/subrion is vulnerable to cross-site scripting. The vulnerability exists because create page functionality of admin account which allows a malicious attacker to inject and execute arbitrary javascript...

CVE-2021-43724

A Cross Site Scripting XSS vulnerability exits in Subrion CMS through 4.2.1 in the Create Page functionality of the admin Account via a SGV file...

CVE-2021-43724

A Cross Site Scripting XSS vulnerability exits in Subrion CMS through 4.2.1 in the Create Page functionality of the admin Account via a SGV file...

Cross site scripting

A Cross Site Scripting XSS vulnerability exits in Subrion CMS through 4.2.1 in the Create Page functionality of the admin Account via a SGV file...

CVE-2021-43724

A Cross Site Scripting XSS vulnerability exits in Subrion CMS through 4.2.1 in the Create Page functionality of the admin Account via a SGV file...

Improper Access Control in Configuration (Credential store)

Description Pandora FMS v7.0NG.759 allows improper access control in Configuration Credential store where a user with the role of Operator Write could create, delete, view existing keys which are outside the intended role. Proof of Concept Affected endpoint: POST...

GSD-2022-1000245 ceph: properly put ceph_string reference after async create attempt

ceph: properly put cephstring reference after async create attempt This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.19 by commit...

WordPress Plugin 访问控制错误漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is a WordPress open source application plugin. WordPress Perfect Brands for WooCommerce has an...

DEBIAN-CVE-2021-43302

Read out-of-bounds in PJSUA API when calling pjsuarecordercreate. An attacker-controlled 'filename' argument may cause an out-of-bounds read when the filename is shorter than 4 characters...

ALPINE-CVE-2021-43299

Stack overflow in PJSUA API when calling pjsuaplayercreate. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation...

UBUNTU-CVE-2021-43302

Read out-of-bounds in PJSUA API when calling pjsuarecordercreate. An attacker-controlled 'filename' argument may cause an out-of-bounds read when the filename is shorter than 4 characters...

UBUNTU-CVE-2021-43300

Stack overflow in PJSUA API when calling pjsuarecordercreate. An attacker-controlled 'filename' argument may cause a buffer overflow since it is copied to a fixed-size stack buffer without any size validation...

CVE-2021-43302

Read out-of-bounds in PJSUA API when calling pjsuarecordercreate. An attacker-controlled 'filename' argument may cause an out-of-bounds read when the filename is shorter than 4 characters...

PT-2022-1915

Name of the Vulnerable Software and Affected Versions PJSIP affected versions not specified Description The issue is related to a stack overflow in the PJSUA API when calling the pjsua recorder create function. An attacker-controlled filename argument may cause a buffer overflow since it is copie...

PT-2022-1922

Name of the Vulnerable Software and Affected Versions PJSIP affected versions not specified Description The issue is related to a buffer overflow error in the PJSUA API when calling the pjsua recorder create function. An attacker-controlled filename argument may cause an out-of-bounds read when t...

PT-2022-1916

Name of the Vulnerable Software and Affected Versions PJSIP affected versions not specified Description The issue is related to a stack overflow in the PJSUA API when calling the pjsua player create function. An attacker-controlled filename argument may cause a buffer overflow since it is copied ...

snipe-it 安全漏洞

Snipe-IT is an open source IT asset/license management system. snipe-it versions prior to 5.3.11 contain an elevation of privilege vulnerability that stems from improper privilege management in the software. An attacker could exploit the vulnerability to cause a non-privileged user to create...

CVE-2022-23707

An XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permissions to create index patterns can inject malicious javascript into the index pattern which could execute against other users...

CVE-2021-44521

When running Apache Cassandra with the following configuration: enableuserdefinedfunctions: true enablescripteduserdefinedfunctions: true enableuserdefinedfunctionsthreads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissio...

GHSA-3C7P-VV5R-CMR5 Incorrect Authorization in Apache Solr

Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous which could be used for remote code execution to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such featur...