PT-2023-9252 · Actiontec · Actiontec Wcb6200Q

Name of the Vulnerable Software and Affected Versions: Actiontec WCB6200Q affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of Actiontec WCB6200Q routers. The flaw exists within the HTTP server, where a...

AZL-31858 CVE-2023-3978 affecting package multus for versions less than 4.0.2-5

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...

AZL-43555 CVE-2023-3978 affecting package podman 4.1.1-26

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...

Controller: Html injection in custom login info

An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise...

DEBIAN-CVE-2022-4912

Type Confusion in MathML in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2022-4926

Insufficient policy enforcement in Intents in Google Chrome on Android prior to 109.0.5414.119 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2021-4318

Object corruption in Blink in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. Chromium security severity: High...

Envoy proxy server HTTP/2 Mixed-Case Scheme Access

The vulnerability of the Envoy proxy server is related to errors in the processing of mixed-case schemes in HTTP/2. Exploiting this vulnerability can allow a remote attacker to gain access to protected data...

PAN-OS Hypertext Access Confidential Data

The vulnerability of the PAN-OS operating system is related to errors in processing hypertext links. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...

SolarWinds Platform Code Injection Vulnerability

SolarWinds Platform is a unified monitoring, observability, and service management platform from SolarWinds USA. A security vulnerability exists in SolarWinds Platform versions prior to 2023.3 that originates from a hole that allows remote attackers with SolarWinds Platform account privileges to...

Oracle Hyperion Essbase Administration Services Unauthorized Access

The vulnerability of the EAS Administration and EAS Console components of the Oracle Hyperion Essbase Administration Services lies in insufficient validation of input data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information using the HTTP...

Oracle Application Express Full Control

The vulnerability of the Application Express development environment for Oracle Application Express is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain full control over the application using the HTTP protocol...

APIkit HTTP Connector OAuth2 Provider Unauthorized Access

The vulnerabilities of the APIkit components, the HTTP connector, and the OAuth2 Provider integrated into the API Gateway environment of Mule Runtime Mule are related to errors in processing the relative path to the restricted directory. Exploiting these vulnerabilities can allow an attacker to...

UBUNTU-CVE-2022-28734

Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally moves its internal data buffer point by one position. This can lead to a out-of-bound write further when parsing the HTTP request, writing a NULL byte past the buffer. It's...

Mojo IPC Library

The vulnerability of the Mojo library in Google Chrome browsers relates to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure or execute arbitrary code using a specially created HTML page...

Google Chrome DevTools Confidential Data Access DoS

The vulnerability of the DevTools suite for web development in the Google Chrome web browser relates to the use of memory after it is released. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause a service failure through the u...

SUSE CVE-2023-3732

Out of bounds memory access in Mojo in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

PT-2023-4948 · Pypi +3 · Aiohttp +3

Name of the Vulnerable Software and Affected Versions: aiohttp versions 3.8.4 and earlier Description: The issue is related to the handling of HTTP requests in aiohttp, which can lead to HTTP request smuggling when a crafted HTTP request is sent. This affects users of aiohttp as an HTTP server, b...

tduck-platform Cross-Site Scripting Vulnerability

TDuckCloud tduck-platform is an open source form survey system from China Zhongda Numerical Wei Information Technology Limited TDuckCloud company. A security vulnerability exists in version v4.0 of tduck-platform, which stems from the presence of an arbitrary file upload vulnerability that allows...

CVE-2023-22009

Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite component: Workforce Management. Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...