444 matches found
squidex 安全漏洞
squidex is a Headless CMS and Content Management Center. A security vulnerability exists in squidex versions prior to 7.4.0 that stems from improper handling of additional special elements...
WordPress Headless CMS Plugin <= 2.0.3 is vulnerable to Broken Authentication
Software Headless CMS Type Plugin Vulnerable versions = 2.0.3 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Authentication CVE CVE-2023-34186 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID 6f4f9877ae87 Credits Yuki Haruma Required privile...
CVE-2023-30843 Payload's hidden fields can be leaked on readable collections
Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Version 1.7.0 contains a patch. As a...
Payload 信息泄露漏洞
Payload is a Headless CMS and application framework built using TypeScript, Node.js, React, and MongoDB. An information disclosure vulnerability exists in Payload versions prior to 1.7.0, which stems from allowing a user to reverse-engineer hidden fields in a readable collection via brute force...
CVE-2023-28446 Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization
Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without any ANSI filtering allows any malicious program to clear the first 2 lines of a opspawnchild or opkill prompt and replace it with any desired text. This wor...
Debian: Security Advisory (DLA-303-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ghost 安全漏洞
Ghost CMS is an open source headless content management system CMS written in JavaScript from the Ghost Foundation in Singapore. A security vulnerability exists in Ghost version 5.35.0 that stems from improper authorization management...
Github saleor 安全漏洞
Github saleor is a headless GraphQL commerce platform that delivers a super-fast, dynamic, personalized shopping experience. Beautiful online store, anywhere, on any device. Github saleor suffers from a security vulnerability that stems from some internal exceptions that are not handled correctly...
CVE-2023-25164
The CVE-2023-25164 entry concerns Tinacms where sites built with @tinacms/cli >= 1.0.0 and
squidex 安全漏洞
squidex is a Headless CMS and Content Management Center. A security vulnerability exists in squidex versions prior to 7.4.0, which stems from the ability to inject Html into Activity...
GHSA-MC52-JPM2-CQH6 Deno is vulnerable to race condition via interactive permission prompt spoofing
Impact Multi-threaded programs were able to spoof interactive permission prompt by rewriting the prompt to suggest that program is waiting on user confirmation to unrelated action. A malicious program could clear the terminal screen after permission prompt was shown and write a generic message li...
CVE-2023-22499
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Multi-threaded programs were able to spoof interactive permission prompt by rewriting the prompt to suggest that program is waiting on user confirmation to unrelated action. A malicious program could clear the...
NSA Ghidra 命令注入漏洞
NSA Ghidra is an open source reverse engineering tool from the National Security Agency NSA. A security vulnerability exists in NSA Ghidra versions 10.2.2 and earlier, which stems from its Ghidra/RuntimeScripts/Linux/support/launch.sh file passing user-supplied input to eval, which when called wi...
PT-2023-9421 · Linux +2 · Linux Kernel +2
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.2.0-rc1-dirty 11 Description: The vulnerability is related to a NULL pointer dereference in the Linux kernel's drm/msm component, specifically when the Adreno GPU is working in headless mode. This can cause an...
Ubuntu: Security Advisory (USN-5770-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
UBUNTU-CVE-2022-39334
Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or...
AlmaLinux 9 : qemu-kvm (ALSA-2022:5263)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:5263 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C...
PT-2022-24863 · Saleor · Saleor
Name of the Vulnerable Software and Affected Versions: Saleor versions prior to 3.1.24 Saleor versions prior to 3.2.14 Saleor versions prior to 3.3.26 Saleor versions prior to 3.4.24 Saleor versions prior to 3.5.23 Saleor versions prior to 3.6.18 Saleor versions prior to 3.7.17 Description: The...
Blender 代码问题漏洞
Blender is a professional free and open source 3D computer graphics software. A code issue exists in Blender where an error is displayed instead of a crash when rendering with "headless builds"...
Rank Math SEO < 1.0.95.1 - Unauthenticated SSRF
The plugin does not properly restrict access to some .htaccess blocked REST endpoints when the headless settings is enabled, which could allow unauthenticated attackers to perform SSRF attacks...