1592 matches found
containerd OCI image importer memory exhaustion
...
CVE-2023-25153 containerd OCI image importer memory exhaustion
containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug h...
CVE-2023-25153 containerd OCI image importer memory exhaustion
containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug h...
SUSE CVE-2005-2971
Heap-based buffer overflow in the KWord RTF importer for KOffice 1.2.0 through 1.4.1 allows remote attackers to execute arbitrary code via a crafted RTF file...
SUSE CVE-2007-0002
Multiple heap-based buffer overflows in WordPerfect Document importer/exporter libwpd before 0.8.9 allow user-assisted remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a crafted WordPerfect file in which values to loop counters are not proper...
SUSE CVE-2007-1466
Integer overflow in the WP6GeneralTextPacket::readContents function in WordPerfect Document importer/exporter libwpd before 0.8.9 allows user-assisted remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a crafted WordPerfect file, a different...
SUSE CVE-2019-16543
Jenkins Spira Importer Plugin 3.2.2 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...
WordPress JSON Content Importer Plugin <= 1.3.15 is vulnerable to Cross Site Scripting (XSS)
Software JSON Content Importer Type Plugin Vulnerable versions = 1.3.15 Fixed in 1.3.16 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25485 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 8e9e1b4a066a Credits Rio Darmawan...
JSON Content Importer < 1.3.16 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
WordPress Auto YouTube Importer Plugin <= 1.0.3 is vulnerable to Cross Site Request Forgery (CSRF)
Software Auto YouTube Importer Type Plugin Vulnerable versions = 1.0.3 Fixed in 1.0.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-23797 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 47682dbd17be Credits Mika Required...
CVE-2023-22852
Tiki through 25.0 allows CSRF attacks that are related to tiki-importer.php and tiki-importsheet.php...
PT-2023-18728 · Tiki · Tiki
Name of the Vulnerable Software and Affected Versions: Tiki versions prior to 25.0 Description: The issue allows for CSRF attacks related to tiki-importer.php and tiki-import sheet.php. Recommendations: For versions prior to 25.0, update to version 25.0 or later to resolve the issue...
CVE-2023-22851
Tiki before 24.2 allows lib/importer/tikiimporterblogwordpress.php PHP Object Injection by an admin because of an unserialize call...
Tiki Wiki CMS Groupware 代码问题漏洞
Tiki Wiki CMS Groupware is a Wiki-based open source content management system and online office suite. A security vulnerability exists in Tiki Wiki CMS Groupware version 24.1 and earlier, which stems from PHP object injection in tikiimporterblogwordpress.php...
Tiki Wiki CMS Groupware 跨站请求伪造漏洞
Tiki is a suite of open source content management and portal applications from the Tiki community that can be used to create web applications, portals, corporate intranets, extranets, and more. A cross-site request forgery vulnerability exists in Tiki Wiki CMS Groupware 25.0 and earlier versions,...
Tiki Wiki CMS Groupware 24.1 tikiimporter_blog_wordpress.php PHP Object Injection
---------------------------------------------------------------------------------------------------- Tiki Wiki CMS Groupware input type="...
AZL-33573 CVE-2022-41717 affecting package containerized-data-importer for versions less than 1.55.0-20
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate...
SUSE: Security Advisory (SUSE-SU-2022:4191-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE SLES15: containerized-data-importer-api / etc (SUSE-SU-2022:4191-1)
The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:4191-1 advisory. This update rebuilds the current containeried data importer images against current base images, to fix security issues. Tenabl...