13398 matches found
libXpm: compression commands depend on $PATH
A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH...
WordPress Extensions For CF7 Plugin <= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF)
Software Extensions For CF7 Type Plugin Vulnerable versions = 2.0.8 Fixed in 2.0.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-23899 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 0538927ff62d Credits István Márton...
Speculative execution attacks in KVM VMX
...
com.buschmais.jqassistant.cli:jqassistant-commandline-neo4jv3 (>=1.4.0, <=1.7.0-ms3), com.buschmais.jqassistant.neo4jserver:neo4jv3 (>=1.4.0, <=1.7.0-ms3) +10 more potentially affected by CVE-2022-23532 via org.neo4j.procedure:apoc (>=3.4.0.1, <=3.5.0.15)
org.neo4j.procedure:apoc MAVEN version =3.4.0.1, =1.4.0, =1.4.0, =1.4.0, =1.8.0, =1.10.0 - org.jqassistant.contrib.plugin:jqassistant-plantuml-rule-plugin 1.7.0 Source cves: CVE-2022-23532 Source advisory: MEND:CVE-2022-23532...
com.buschmais.jqassistant.cli:jqassistant-commandline-neo4jv3 (1.4.0), com.buschmais.jqassistant.neo4jserver:neo4jv3 (1.4.0) +8 more potentially affected by CVE-2022-23532 via org.neo4j.procedure:apoc (3.4.0.1)
org.neo4j.procedure:apoc MAVEN version 3.4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j.procedure:apoc and may be impacted: - com.buschmais.jqassistant.cli:jqassistant-commandline-neo4jv3 1.4.0 -...
ALPINE-CVE-2022-3515
A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment...
CVE-2022-3592
A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks...
CVE-2022-3592
A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks...
CVE-2022-3592: UNIX Symbolic Link (Symlink) Following
A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks...
Google Chrome Buffer Overflow Vulnerability (CNVD-2023-12026)
Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a security vulnerability that originates from a boundary error in the platform application for untrusted inputs, which can be exploited by a remote attacker to convince users to install malicious extension...
GLSA-202301-09 : protobuf-java: Denial of Service
The remote host is affected by the vulnerability described in GLSA-202301-09 protobuf-java: Denial of Service - A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple...
Google Chrome Resource Management Error Vulnerability
Google Chrome is a web browser from Google, Inc. in the United States. Google Chrome has a security vulnerability that stems from the use of free in the shopping cart allows an attacker to convince users to install malicious extensions, an attacker can exploit the vulnerability by exploiting heap...
CVE-2023-0134
Use after free in Cart in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via database corruption and a crafted HTML page. Chromium security severity: Medium...
Google Chrome Resource Management Error Vulnerability
Google Chrome is a web browser from Google, Inc. in the United States. Google Chrome has a security vulnerability that stems from the use of free in the shopping cart allows an attacker to convince users to install malicious extensions, an attacker can exploit the vulnerability by exploiting heap...
Hackers Can Abuse Visual Studio Marketplace to Target Developers with Malicious Extensions
A new attack vector targeting the Visual Studio Code extensions marketplace could be leveraged to upload rogue extensions masquerading as their legitimate counterparts with the goal of mounting supply chain attacks. The technique "could act as an entry point for an attack on many organizations,"...
Hackers Can Abuse Visual Studio Marketplace to Target Developers with Malicious Extensions
A new attack vector targeting the Visual Studio Code extensions marketplace could be leveraged to upload rogue extensions masquerading as their legitimate counterparts with the goal of mounting supply chain attacks. The technique "could act as an entry point for an attack on many organizations,"...
CVE-2018-25065
A vulnerability was found in Wikimedia mediawiki-extensions-I18nTags and classified as problematic. This issue affects some unknown processing of the file I18nTagsbody.php of the component Unlike Parser. The manipulation leads to cross site scripting. The attack may be initiated remotely. The...
CVE-2018-25065
A vulnerability was found in Wikimedia mediawiki-extensions-I18nTags and classified as problematic. This issue affects some unknown processing of the file I18nTagsbody.php of the component Unlike Parser. The manipulation leads to cross site scripting. The attack may be initiated remotely. The...
CVE-2018-25065: Improper Neutralization of Input During Web Page Generation
A vulnerability was found in Wikimedia mediawiki-extensions-I18nTags and classified as problematic. This issue affects some unknown processing of the file I18nTagsbody.php of the component Unlike Parser. The manipulation leads to cross site scripting. The attack may be initiated remotely. The...