PT-2023-31774

Name of the Vulnerable Software and Affected Versions Live updates from Excel plugin for WordPress versions up to, and including, 2.3.2 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'ipushpull page' shortcode due to insufficient input sanitization and output...

CVE-2023-5116: Improper Neutralization of Input During Web Page Generation

The Live updates from Excel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ipushpullpage' shortcode in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Google Android 缓冲区错误漏洞

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that stems from a lack of bounds checking in libdexfile, which can be exploited by an attacker to cause an elevation of privilege...

CVE-2021-33638

When the isula cp command is used to copy files from a container to a host machine and the container is controlled by an attacker, the attacker can escape the container...

tar: heap buffer overflow at from_header() in list.c via specially crafted checksum

A flaw was found in the Tar package. When attempting to read files with old V7 tar format with a specially crafted checksum, an invalid memory read may occur. An attacker could possibly use this issue to expose sensitive information or cause a crash...

PYSEC-2023-195

OctoPrint is a web interface for 3D printers. OctoPrint versions up until and including 1.9.2 contain a vulnerability that allows malicious admins to configure a specially crafted GCODE script that will allow code execution during rendering of that script. An attacker might use this to extract da...

Malicious code in narratives-from-tweets (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1570135eff60eea1dfd9ec7b66797d9454373263050b83c8ad90d2b7b37d71b6 The OpenSSF Package Analysis project identified 'narratives-from-tweets' @ 0.1 pypi as malicious. It is considered malicious because: - The...

CVE-2023-44238: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Joakim Ling Remove slug from custom post type plugin = 1.0.3 versions...

CVE-2023-44762

A Cross Site Scripting XSS vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2 allows an attacker to execute arbitrary code via a crafted script to the Tags from Settings - Tags...

CVE-2023-44762

A Cross Site Scripting XSS vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2 allows an attacker to execute arbitrary code via a crafted script to the Tags from Settings - Tags...

CVE-2023-25489

Cross-Site Request Forgery CSRF vulnerability in Jeff Sherk Update Theme and Plugins from Zip File plugin = 2.0.0 versions...

CVE-2023-25489

CVE-2023-25489 is a CSRF vulnerability in the WordPress plugin Update Theme and Plugins from Zip File (versions

CVE-2023-25489: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Jeff Sherk Update Theme and Plugins from Zip File plugin = 2.0.0 versions...

Electrolink FM/DAB/TV Transmitter (controlloLogin.js) Credential Disclosure

Electrolink FM/DAB/TV Transmitter controlloLogin.js Credentials Disclosure Vendor: Electrolink s.r.l. Product web page: https://www.electrolink.com Affected version: 10W, 100W, 250W, Compact DAB Transmitter 500W, 1kW, 2kW Medium DAB Transmitter 2.5kW, 3kW, 4kW, 5kW High Power DAB Transmitter 100W...

The vulnerability of the fromSetWirelessRepeat function in the Tenda A18 router’s microprogramming software allows a hacker to cause a service failure.

The vulnerability of the fromSetWirelessRepeat function in Tenda A18 router microprogramming software is related to the possibility of writing data outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures...

GHSA-C647-PXM2-C52W Vyper vulnerable to memory corruption in certain builtins utilizing `msize`

Impact In certain conditions, the memory used by the builtins rawcall, createfromblueprint and createcopyof can be corrupted. - For rawcall, the argument buffer of the call can be corrupted, leading to incorrect calldata in the sub-context. - For createfromblueprint and createcopyof, the buffer f...

PT-2023-28837

Name of the Vulnerable Software and Affected Versions Telstra Smart Modem Gen 2 Arcadyan LH1000 versions prior to 0.18.15r Description The ping from parameter of ping tracerte.cgi in the web UI was not properly sanitized before being used in a system call, which could allow an authenticated...

PYSEC-2023-306

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In version 0.3.9 and prior, under certain conditions, the memory used by the builtins rawcall, createfromblueprint and createcopyof can be corrupted. For rawcall, the argument buffer of the call can be corrupted,...

PYSEC-2023-306

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In version 0.3.9 and prior, under certain conditions, the memory used by the builtins rawcall, createfromblueprint and createcopyof can be corrupted. For rawcall, the argument buffer of the call can be corrupted,...

Vyper Buffer Error Vulnerability

Vyper is the Pythonic smart contract language for EVM. A buffer error vulnerability exists in versions of Vyper prior to 0.3.10, which stems from the fact that the memory createfromblueprint and possibly createcopyof used by built-in functions can become corrupted under certain circumstances...