Nextcloud 信息泄露漏洞

Nextcloud is a set of open source self-hosted file synchronization and sharing communication applications platform from Nextcloud Germany.A security vulnerability exists in Nextcloud Server, which is due to an issue with the Nextcloud Text application which is provided with Nextcloud Server by...

PT-2022-11375 · Nextcloud +1 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 20.0.14 Nextcloud Server versions prior to 21.0.6 Nextcloud Server versions prior to 22.2.1 Description: The Nextcloud Text application, which is shipped with Nextcloud Server by default, has an issue that...

SUSE: Security Advisory (SUSE-SU-2022:0733-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2022:0696-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 91.6.0 ESR / MFSA 2022-05 bsc1195682 - CVE-2022-22753: Privilege Escalation to SYSTEM on Windows via Maintenance Service - CVE-2022-22754: Extensions could have bypassed permission confirmation during upda...

SUSE SLES15 Security Update : MozillaFirefox (SUSE-SU-2022:0676-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0676-1 advisory. - A Time-of-Check Time-of-Use bug existed in the Maintenance Updater Service that could be abused to grant Users write access to an...

PT-2022-7614 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to commit 5e70bc8 Description: The vulnerability is related to the btrfs file system in the Linux kernel. It occurs when a pending balance is waiting to get the cleaner mutex, and a snapshot deletion is running, an...

Microweber logic flaw vulnerability

Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. A logic flaw vulnerability exists in Microweber, which stems from an error in the business...

CVE-2021-24689

The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server via a path traversal attack...

CVE-2022-0360

CVE-2022-0360 affects the WordPress plugin WP Ultimate CSV Importer (versions prior to 6.4.3). The root cause is failure to sanitise and escape imported comments, enabling stored Cross-Site Scripting (XSS) by high-privilege users who import malicious comments. Documented evidence shows an admin+ ...

CVE-2021-24689

CVE-2021-24689 concerns the WordPress plugin Contact Forms - Drag & Drop Contact Form Builder (versions up to 1.0.5). The vulnerability is a path traversal flaw that allows high-privilege users to download arbitrary files from the web server, via the plugin’s file download feature. The core issue...

WordPress Customizer custom controls with Drag and Drop builder – Customizely plugin <= 1.1.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Customizer custom controls with Drag and Drop builder – Customizely plugin versions = 1.1.0. Solution Update the WordPress Customizer custom controls with Drag and Drop builder – Customizely plugin to the latest available...

WordPress Anfrageformular – Multi Step Drag & Drop Formular Builder – Leadgenerierung plugin <= 1.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Anfrageformular – Multi Step Drag & Drop Formular Builder – Leadgenerierung plugin versions = 1.2. Solution No patched version available...

WordPress Anfrageformular – Multi Step Drag & Drop Formular Builder – Leadgenerierung plugin <= 1.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Anfrageformular – Multi Step Drag & Drop Formular Builder – Leadgenerierung plugin versions = 1.2. Solution No patched version available...

WordPress Drop Shadow Boxes plugin <= 1.7.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Drop Shadow Boxes plugin versions = 1.7.4. Solution Update the WordPress Drop Shadow Boxes plugin to the latest available version at least 1.7.5...

WordPress plugin 路径遍历漏洞

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An arbitrary file download vulnerability exists in Wordpress Drag & Drop Contact Form Plugin 1.0.5 and earlier...

WordPress Drop Shadow Boxes plugin <= 1.7.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Drop Shadow Boxes plugin versions = 1.7.4. Solution Update the WordPress Drop Shadow Boxes plugin to the latest available version at least 1.7.5...

WordPress Drag and Drop & Multiple Image Uploads With Preview For WPForms plugin <= 1.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Drag and Drop & Multiple Image Uploads With Preview For WPForms plugin versions = 1.3. Solution No patched version available...

GSD-2022-1000642 net/mlx5e: Avoid implicit modify hdr for decap drop rule

net/mlx5e: Avoid implicit modify hdr for decap drop rule This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.6 by commit...

GSD-2022-1000552 drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit

dropmonitor: fix data-race in dropmonnetevent / tracenapipollhit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.11 by commit...

GSD-2022-1000353 drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit

dropmonitor: fix data-race in dropmonnetevent / tracenapipollhit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.181 by commit...