ms-mnhradiste.cz Cross Site Scripting vulnerability OBB-2878018

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-2953

LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 48d6ece8...

CVE-2022-37806

Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the page parameter in the function fromDhcpListClient...

GitLab 11.3.4 < 15.1.5, 15.2.x < 15.2.3, 15.3.x < 15.3.1 RCE Vulnerability

GitLab is prone to a remote command execution RCE vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitlab:gitlab"; ...

Vulnerabilities fixed in GitLab Enterprise Edition and GitLab Community Edition

GitLab has fixed a vulnerability in GitLab Enterprise Edition and GitLab Community Edition. An authenticated malicious party could exploit the vulnerability to execute arbitrary code via the 'Import from GitHub' API Endpoint to execute arbitrary code with permissions from the application and...

Malicious code in reuqireindex (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fbbda71d59cce232422b43f3d5cd8923e9e025ce2cd238379b63983bbdbfd91c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1698 Malicious code in brsolve-from (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b9ab4931993c5c8629dc09a0d65d0dfecc2fcc2a7aa7428a09c20ff248cbf4d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in brsolve-from (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b9ab4931993c5c8629dc09a0d65d0dfecc2fcc2a7aa7428a09c20ff248cbf4d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-37199

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack-buffer-overflow crash. Technical details about the crash include the functions gs glyph data from bytes, pdfi cff subr data...

CVE-2022-37047

The component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in getipv6next at common/get.c:713. NOTE: this is different from CVE-2022-27940...

CVE-2022-37047

The component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in getipv6next at common/get.c:713. NOTE: this is different from CVE-2022-27940...

PT-2022-37188

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack-buffer-overflow crash. Technical details about the crash include the functions gs glyph data from string, copied type1 subr...

aalborgstift.dk Cross Site Scripting vulnerability OBB-2841857

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-20338

In HierarchicalUri.readFrom of Uri.java, there is a possible way to craft a malformed Uri object due to improper input validation. This could lead to a local escalation of privilege, preventing processes from validating URIs correctly, with no additional execution privileges needed. User...

mariadb: server crashes in query_arena::set_query_arena upon SELECT from view

A flaw was found in the MariaDB Server. It contains a segmentation fault via the component, sql/sqlclass.cc, impacting availability...

adicciones.barcelona Cross Site Scripting vulnerability OBB-2827172

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Expense Management System SQL注入漏洞

Expense Management System is an expense management system by Carlo Montero Personal Developer. SourceCodester Expense Management System suffers from a SQL injection vulnerability that originates in the report.php component where the POST parameter handler of the fetchreportcredit function operate...

mariadb: server crashes in query_arena::set_query_arena upon SELECT from view

A flaw was found in the MariaDB Server. It contains a segmentation fault via the component, sql/sqlclass.cc, impacting availability...

CVE-2022-2278: Improper Neutralization of Input During Web Page Generation

The Featured Image from URL FIFU WordPress plugin before 4.0.1 does not validate, sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite...

WordPress plugin Featured Image from URL (FIFU) 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...