5355 matches found
PT-2023-16918 · Liferea +2 · Liferea +2
Name of the Vulnerable Software and Affected Versions: liferea affected versions not specified Description: A critical issue has been found, affecting the function update job run of the file src/update.c in the component Feed Enrichment. The manipulation of the argument source with the input |dat...
[R1] Tenable Plugin Feed ID #202212081952 Fixes Arbitrary Code Execution Vulnerability
R1 Tenable Plugin Feed ID 202212081952 Fixes Arbitrary Code Execution Vulnerability Arnie Cabral Fri, 03/10/2023 - 16:28 Audit files that are built into the Tenable products provide capability to adjust the audit evaluation to meet organizational requirements. A vulnerability was reported where...
CVE-2019-8720
creationtimestamp| type| source ---|---|--- 2023-03-07 02:13:24+00:00| seen| https://t.me/cibsecurity/59535 2023-06-14 21:10:04+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2024-12-24 20:31:01+00:00| seen| https://feedsin.space/feed/CISAKevBot/items/2971552 2025-02-23 02:10:25+00:00|...
Price manipulation attack
Lines of code Vulnerability details Impact The PriceFeed.sol was marked OOS but I believe this to be a valid issue. If the chainlink feed fails which is does from time to time, the Tellor price feed takes over no matter what the delta is compared to the chainlink price. This is an issue because t...
Atlassian Confluence 6.4.1 < 6.5.2 Cross-Site Scripting Via RSS macro
According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to version 6.5.2. It is, therefore, affected by a flaw in the RSS Feed macro handling in Atlassian Confluence which may permit remote attackers to inject arbitrary HTML or...
CVE-2023-26491
RSSHub is affected by a cross-site scripting (XSS) vulnerability caused by improper handling of certain special characters in URL parameters. The issue allows an attacker to execute arbitrary JavaScript when users access a deliberately constructed URL. A fix was committed in version c910c4d28717f...
GHSA-7RQG-HJWC-6MJF Grafana vulnerable to Stored Cross-site Scripting in Text plugin
Description On 2023-01-01 during an internal audit of Grafana, a member of the security team found a stored XSS vulnerability affecting the core plugin "Text". The stored XSS vulnerability requires several user interactions in order to be fully exploited. The vulnerability was possible due to...
CVE-2022-46797
CVE-2022-46797 concerns the WordPress plugin Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce, affected versions are 5.2.3, with Patchstack listing 5.2.4 as the fix. Exploit details or in-the-wild activity are not provided in the supplied documents. Recommen...
Feed Them Social <= 3.0.2 - Settings Update via CSRF
The plugin does not have CSRF check when updating its settings, which could allow attackers to make logged in admins perform such action via a CSRF attack...
CVE-2022-41223
creationtimestamp| type| source ---|---|--- 2023-02-22 06:49:53+00:00| exploited| https://t.me/thehackernews/3079 2023-02-22 12:24:29+00:00| seen| Telegram/2I9R6FliHquwURRb8t5QNFGxrnLnYILqhcQxv35YCmjG 2023-06-14 21:10:04+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2024-12-24...
CVE-2023-25157
creationtimestamp| type| source ---|---|--- 2023-02-22 00:47:08+00:00| seen| https://t.me/cibsecurity/58649 2023-06-06 14:16:00+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/4498 2023-06-07 15:39:22+00:00| published-proof-of-concept| https://t.me/dilagrafie/3079 2023-06-08...
K16937: OpenSSL vulnerability CVE-2015-1793
Security Advisory Description Description The X509verifycert function in crypto/x509/x509vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints CA values during identification of alternative certificate chains, which allows remote attackers to spoof ...
K15399: Usermin remote vulnerability CVE-2014-3883
Security Advisory Description Description Usermin before 1.600 allows remote attackers to execute arbitrary operating-system commands via unspecified vectors related to a user action. CVE-2014-3883 Impact None. No F5 products are vulnerable to this vulnerability. Status F5 Product Development has...
K03861222: ExtJS vulnerability CVE-2007-2285
Security Advisory Description Directory traversal vulnerability in examples/layout/feed-proxy.php in Jack Slocum Ext 1.0 alpha1 Ext JS allows remote attackers to read arbitrary files via a .. dot dot in the feed parameter. NOTE: analysis by third party researchers indicates that this issue might ...
K16882: OpenLDAP vulnerability CVE-2013-4449
Security Advisory Description Description The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service slapd crash by unbinding immediately after a search request, which triggers rwmconndestroy to free the...
K16794: CUPS vulnerabilities CVE-2015-1158 / CVE-2015-1159
Security Advisory Description Description CVE-2015-1158 A string reference count bug was found in cupsd, causing premature freeing of string objects. An attacker can submit a malicious print job that exploits this flaw to dismantle ACLs protecting privileged operations, allowing a replacement...
WordPress Feed Them Social Plugin <= 3.0.2 is vulnerable to Cross Site Request Forgery (CSRF)
Software Feed Them Social Type Plugin Vulnerable versions = 3.0.2 Fixed in 4.0.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25056 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d0bf770b4cc9 Credits Rio Darmawan...
Price feed in MCAGRateFeed#getRate is not sufficiently validated and can return stale price
Lines of code Vulnerability details Impact MCAGRateFeedgetRate may return stale data Proof of Concept , int256 answer,,, = oracle.latestRoundData; Classic C4 issue. getRate only uses answer but never checks the freshness of the data, which can lead to stale bond pricing data. Stale pricing data c...
