550 matches found
[SECURITY] Fedora 37 Update: godot-4.1.2-1.fc37
Godot is an advanced, feature-packed, multi-platform 2D and 3D game engine. It provides a huge set of common tools, so you can just focus on making your game without reinventing the wheel. Godot is completely free and open source under the very permissive MIT license. No strings attached, no...
[SECURITY] Fedora 37 Update: gdb-13.2-3.fc37
'gdb' package is only a stub to install gcc-gdb-plugin for 'compile' commands. See package 'gdb-headless'...
PYSEC-2023-184
opencv-python-headless versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-python-headless v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2...
PYSEC-2023-182
opencv-contrib-python-headless versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-contrib-python-headless v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2...
Badaso 跨站脚本漏洞
Badaso is Uasoft open source an open source Laravel Vue headless CMS. Badosa v2.9.7 version of the cross-site scripting vulnerability , the vulnerability stems from the application of the user-supplied data lack of effective filtering and escaping , an attacker can exploit the vulnerability throu...
CVE-2023-41167
@webiny/react-rich-text-renderer before 5.37.2 allows XSS attacks by content managers. This is a react component to render data coming from Webiny Headless CMS and Webiny Form Builder. Webiny is an open-source serverless enterprise CMS. The @webiny/react-rich-text-renderer package depends on the...
CVE-2023-41167
@webiny/react-rich-text-renderer before 5.37.2 allows XSS attacks by content managers. This is a react component to render data coming from Webiny Headless CMS and Webiny Form Builder. Webiny is an open-source serverless enterprise CMS. The @webiny/react-rich-text-renderer package depends on the...
CrafterCMS is an open source headless CMS for enterprise-level websites and other content-driven digital experiences, especially those that are high-performance, large-scale and ultra-secure. CrafterCMS suffers from a cross-site scripting vulnerability in versions 3.1.0 through 3.1.27 and 4.0.0 through 4.0.2. The vulnerability is due to improper neutralization of inputs during page generation allowing for reflected XSS.No detailed vulnerability details are available at this time.
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
squidex 安全漏洞
squidex is a Headless CMS and Content Management Center. A security vulnerability exists in squidex versions prior to 7.4.0 that stems from improper handling of additional special elements...
WordPress Headless CMS Plugin <= 2.0.3 is vulnerable to Broken Authentication
Software Headless CMS Type Plugin Vulnerable versions = 2.0.3 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Authentication CVE CVE-2023-34186 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID 6f4f9877ae87 Credits Yuki Haruma Required privile...
CVE-2023-30843 Payload's hidden fields can be leaked on readable collections
Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Version 1.7.0 contains a patch. As a...
Payload 信息泄露漏洞
Payload is a Headless CMS and application framework built using TypeScript, Node.js, React, and MongoDB. An information disclosure vulnerability exists in Payload versions prior to 1.7.0, which stems from allowing a user to reverse-engineer hidden fields in a readable collection via brute force...
CVE-2023-28446 Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization
Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without any ANSI filtering allows any malicious program to clear the first 2 lines of a opspawnchild or opkill prompt and replace it with any desired text. This wor...
Debian: Security Advisory (DLA-303-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ghost 安全漏洞
Ghost CMS is an open source headless content management system CMS written in JavaScript from the Ghost Foundation in Singapore. A security vulnerability exists in Ghost version 5.35.0 that stems from improper authorization management...
Github saleor 安全漏洞
Github saleor is a headless GraphQL commerce platform that delivers a super-fast, dynamic, personalized shopping experience. Beautiful online store, anywhere, on any device. Github saleor suffers from a security vulnerability that stems from some internal exceptions that are not handled correctly...
CVE-2023-25164
The CVE-2023-25164 entry concerns Tinacms where sites built with @tinacms/cli >= 1.0.0 and
squidex 安全漏洞
squidex is a Headless CMS and Content Management Center. A security vulnerability exists in squidex versions prior to 7.4.0, which stems from the ability to inject Html into Activity...
GHSA-MC52-JPM2-CQH6 Deno is vulnerable to race condition via interactive permission prompt spoofing
Impact Multi-threaded programs were able to spoof interactive permission prompt by rewriting the prompt to suggest that program is waiting on user confirmation to unrelated action. A malicious program could clear the terminal screen after permission prompt was shown and write a generic message li...
CVE-2023-22499
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Multi-threaded programs were able to spoof interactive permission prompt by rewriting the prompt to suggest that program is waiting on user confirmation to unrelated action. A malicious program could clear the...