RockMongo 1.1.7 - Stored Cross-Site Scripting Vulnerability

Exploit Title: RockMongo 1.1.7 - Stored Cross-Site Scripting XSS Discovery by: Rafael Pedrero Vendor Homepage: https://github.com/iwind/rockmongo/ Software Link : https://github.com/iwind/rockmongo/ Tested Version: 1.1.7 Tested on: Windows 7 and 10 Vulnerability Type: Stored Cross-Site Scripting...

The vulnerability of the jfif_encode() function in the FFJPEG library for encoding and decoding JPEG files allows a attacker to cause a service failure.

The vulnerability of the jfifencode function ffjpeg/src/jfif.c in the library for encoding and decoding JPEG files allows for the copying of buffers without checking the size of the input data. Exploiting this vulnerability could enable a remote attacker to cause service interruptions...

golang: net/http: improper sanitization of Transfer-Encoding header

A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating "chunked" encoding. This issue could allow request smuggling, but only if combined with an intermediate server that also improperly accepts the header as invalid...

Moderate: Red Hat Security Advisory: git-lfs security and bug fix update

An update for git-lfs is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

golang: encoding/gob: stack exhaustion in Decoder.Decode

A flaw was found in golang. When calling Decoder, Decode on a message that contains deeply nested structures, a panic can occur due to stack exhaustion and allows an attacker to impact system availability...

CVE-2023-29188

SAP CRM WebClient UI - versions SAPSCORE 129, S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS...

PT-2023-2940 · Sap · Sap Crm Webclient Ui

Name of the Vulnerable Software and Affected Versions: SAP CRM WebClient UI versions SAPSCORE 129, S4FND 102 through S4FND 107, WEBCUIF 701 through WEBCUIF 801 Description: The SAP CRM WebClient UI does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting XSS issue...

PT-2023-22946 · Sap · Sap Crm +1

Name of the Vulnerable Software and Affected Versions: SAP CRM WebClient UI versions S4FND 102 through S4FND 107, WEBCUIF 700 through WEBCUIF 801 Description: The issue arises from insufficient encoding of user-controlled inputs, leading to a stored Cross-Site Scripting XSS vulnerability. An...

UNISOC Chipsets 缓冲区错误漏洞

UNISOC Chipsets is a chipset from China's Purple Spreadtrum UNISOC. A security vulnerability exists in the UNISOC Chipsets MP3 encoder module, which stems from a lack of boundary checking, resulting in out-of-bounds writes...

Huawei EulerOS: Security Advisory for expat (EulerOS-SA-2023-1707)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Improper Encoding or Escaping of Output

Overview std/html/template is a Go standard library package std/html/template Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output. Go Vulnerability Report:Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing...

keycloak: path traversal via double URL encoding

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. Thi...

Amazon Linux AMI : libxml2 (ALAS-2023-1743)

The version of libxml2 installed on the remote host is prior to 2.9.1-6.6.42. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1743 advisory. parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the...

libwebp 资源管理错误漏洞

libwebp is a library for encoding and decoding the WebP image format. A resource management error vulnerability exists in libwebp that stems from a lack of memory in the VP8 encoder, which can lead to memory reuse after release...

Medium: libxml2

Issue Overview: parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name. CVE-2017-16931 GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in...

The vulnerability of the jfif_encode() function in the FFJPEG library for encoding and decoding JPEG files allows a attacker to cause a service failure.

The vulnerability of the jfifencode function in the FFJPEG library for encoding and decoding JPEG files is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to cause service interruptions...

UBUNTU-CVE-2023-31470

SmartDNS through 41 before 56d0332 allows an out-of-bounds write because of a stack-based buffer overflow in the dnsencodedomain function in the dns.c file, via a crafted DNS request...

Improper Encoding

Flatpak is vulnerable to Improper Encoding. A malicious attacker to craft a flatpack app with elevated permisions and hide them from its users which is resulted due to improper encoding...

DNS wire format AND DNS label-sequence format ARE USED INTERCHANGABLY TO REPRESENT DOMAIN NAMES DURING RRSet VALIDATION

Lines of code Vulnerability details Impact @param name The name to claim, in DNS wire format. above format is used in DNSRegistrar.proveAndClaim and DNSRegistrar.proveAndClaimWithResolver functions @param name The name of the RRSIG record, in DNS label-sequence format. above format is used in...

[SECURITY] Fedora 36 Update: protobuf-3.19.6-1.fc36

Protocol Buffers are a way of encoding structured data in an efficient yet extensible format. Google uses Protocol Buffers for almost all of its internal RPC protocols and file formats. Protocol buffers are a flexible, efficient, automated mechanism for serializing structured data...