CVE-2022-44637

Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on the configuration, this may require login as a registered user...

CVE-2022-44031

Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote syntax in Textile-formatted fields...

Redmine 跨站脚本漏洞

Redmine is a set of open source Web-based project management and defect tracking tools . The product provides features such as project management, issue tracking and role-based access control. A cross-site scripting vulnerability exists in Redmine versions prior to 4.2.9 and 5.0.x through 5.0.4,...

CVE-2022-44637

CVE-2022-44637 affects Redmine before 4.2.9 and 5.0.x before 5.0.4, where persistent XSS can be triggered via the Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on configuration, exploitation may require login as a registered user. Root cause: insu...

CVE-2022-44031

Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS via Textile formatter due to improper sanitization of blockquote syntax in Textile-formatted fields. Affected versions should upgrade to at least Redmine 4.2.9 and 5.0.4. No exploit details are provided in the sources; note that th...

CVE-2022-44031

Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote syntax in Textile-formatted fields...

CVE-2022-44637

Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on the configuration, this may require login as a registered user...

Improper Input Validation

dalli is vulnerable to improper input validation. The vulnerability is due to improper neutralizations in the self.metaset function of requestformatter.rb, allowing attackers to inject code through the delay parameter in the flushall method...

Dalli 注入漏洞

Dalli is a high-performance pure Ruby client for accessing memcached servers by Peter Goldstein, a personal developer. Dalli suffers from an injection vulnerability that stems from an affected self.metaset function in the lib/dalli/protocol/meta/requestformatter.rb file of the component Meta...

PT-2022-7391 · Siemens +1 · Simatic Step 7 +2

Name of the Vulnerable Software and Affected Versions: SIMATIC PCS neo version 4.0 SIMATIC STEP 7 versions 16 through 17 SIMATIC STEP 7 versions 18 through 18 Update 1 Description: A vulnerability has been identified in the affected applications, which do not properly restrict the .NET...

Malicious code in @nexthink/data-formatter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f188943d8227d8913a6413c93f5a6c9f6e0246b043ca4ff832de679014a59b06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-462 Malicious code in @nexthink/data-formatter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f188943d8227d8913a6413c93f5a6c9f6e0246b043ca4ff832de679014a59b06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

FreeBSD : zydis -- heap buffer overflow (d487d4fc-43a8-11ed-8b01-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the d487d4fc-43a8-11ed-8b01-b42e991fc52e advisory. - Zydis is an x86/x86-64 disassembler library. Users of Zydis versions v3.2.0 and older that use the...

CVE-2022-28684

This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulnerability. The specific flaw exists within the SafeBinaryFormatter library. The issue results from the lack of proper validation of...

[SECURITY] Fedora 36 Update: golang-mvdan-sh-3-3.4.3-5.fc36

A shell parser, formatter, and interpreter. Supports POSIX Shell, Bash, and mksh...

[SECURITY] Fedora 35 Update: golang-mvdan-sh-3-3.4.3-4.fc35

A shell parser, formatter, and interpreter. Supports POSIX Shell, Bash, and mksh...

XSS vulnerability in Jenkins Markdown Formatter Plugin

Jenkins Markdown Formatter Plugin 0.1.0 and earlier uses a Markdown library to parse Markdown that does not escape crafted link target URLs. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with the ability to edit any description rendered using the...

GHSA-XQPP-26PP-2365 XSS vulnerability in Jenkins Markdown Formatter Plugin

Jenkins Markdown Formatter Plugin 0.1.0 and earlier uses a Markdown library to parse Markdown that does not escape crafted link target URLs. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with the ability to edit any description rendered using the...

Reflected XSS vulnerability in Jenkins markup formatter preview

Jenkins allows administrators to choose the markup formatter to use for descriptions of jobs, builds, views, etc. displayed in Jenkins. When editing such a description, users can choose to have Jenkins render a formatted preview of the description they entered. Jenkins 2.274 and earlier, LTS...

GHSA-7QF3-C2Q8-69M3 Reflected XSS vulnerability in Jenkins markup formatter preview

Jenkins allows administrators to choose the markup formatter to use for descriptions of jobs, builds, views, etc. displayed in Jenkins. When editing such a description, users can choose to have Jenkins render a formatted preview of the description they entered. Jenkins 2.274 and earlier, LTS...