WordPress FileBird Document Library plugin <= 2.0.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Peng Zhou Patchstack Alliance in WordPress Plugin FileBird Document Library versions = 2.0.6...

TCPDF 安全漏洞

TCPDF is an open source library from Tecnick. It is used to generate PDF documents and barcodes. TCPDF 6.7.4 and earlier versions have a security vulnerability that stems from vulnerability to ReDoS Regular Expression Denial of Service attacks...

Description of the security update for SharePoint Server Subscription Edition: November 14, 2023 (KB5002527)

None None...

Description of the security update for SharePoint Server Subscription Edition: September 12, 2023 (KB5002474)

None None...

WordPress Filr – Secure document library Plugin < 1.2.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Filr – Secure document library Type Plugin Vulnerable versions 1.2.3.1 Fixed in 1.2.3.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Patrick Posner PSID 4238a0e05073 Credits Rafie Muhammad...

The vulnerability of the Dict::find() function in the Dict.cc component of the Poppler PDF handling library allows a attacker to cause a service failure.

The vulnerability of the Dict::find function in the Dict.cc component of the Poppler PDF handling library is related to writing beyond the buffer boundaries. Exploiting this vulnerability allows a malicious actor to cause service interruptions by using a specially created PDF file...

Maggioli SpA Appalti & Contratti 安全漏洞

Maggioli SpA Appalti & Contratti is a modular platform of Maggioli SpA. It consists of several integrated web applications to support Italian public administrations in the computerization and telematics management of their processes. A security vulnerability exists in Maggioli SpA Appalti &...

The vulnerability of the xmlParseNameComplex() function in the XML document analysis library libxml2 allows a attacker to execute arbitrary code or cause a service denial-of-service attack.

The vulnerability of the xmlParseNameComplex function in the XML document analysis library libxml2 is related to integer overflow when processing content with the XMLPARSEHUGE parameter. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code or cause service failure...

com.liferay:com.liferay.document.library.layout.set.prototype (>=1.0.0 <=2.0.10), com.liferay:com.liferay.frontend.image.editor.integration.document.library (>=1.0.0 <=1.0.16) potentially affected by CVE-2022-42113 via com.liferay:com.liferay.document.library.web (=1.0.0)

com.liferay:com.liferay.document.library.web MAVEN version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.liferay:com.liferay.document.library.web and may be impacted: - com.liferay:com.liferay.document.library.layout.set.prototype =1.0.0,...

Liferay Portal and Liferay DXP Vulnerable to XSS via the Document Library Module

A Cross-site scripting XSS vulnerability in Document Library module before 6.0.98 from Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter...

GHSA-R32W-V775-5952 Liferay Portal and Liferay DXP Vulnerable to XSS via the Document Library Module

A Cross-site scripting XSS vulnerability in Document Library module before 6.0.98 from Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter...

Cross site scripting

A Cross-site scripting XSS vulnerability in Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter...

CVE-2022-42113

A Cross-site scripting XSS vulnerability in Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter...

Liferay Portal 跨站脚本漏洞

Liferay Portal is a J2EE-based portal solution from Liferay, Inc. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social networking, etc. A security vulnerability exists in Liferay Portal versi...

CVE-2022-42113

A Cross-site scripting XSS vulnerability in Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter...

CVE-2022-42113

CVE-2022-42113 is a documented XSS vulnerability in the Document Library module affecting Liferay Portal 7.4.3.30–7.4.3.36 and Liferay DXP 7.4 update 30–36. The issue allows remote attackers to inject arbitrary web script or HTML via the redirect parameter. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:...

CVE-2022-42113

A Cross-site scripting XSS vulnerability in Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter...

Office 365 Config Loophole Opens OneDrive, SharePoint Data to Ransomware Attack

Researchers are warning attackers can abuse Microsoft Office 365 functionality to target files stored on SharePoint and OneDrive in ransomware attacks. Those files, stored via “auto-save” and backed-up in the cloud, typically leave end users with the impression data is shielded from a ransomware...

Description of the security update for SharePoint Server Subscription Edition: June 14, 2022 (KB5002224)

None None...

CVE-2022-1777 Filr - Secure Document Library < 1.2.2.1 - Subscriber+ AJAX Calls

The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, such as subscriber. They are are protected with a nonce, however the nonce is leaked on the dashboard. This could allow them to upload...