PYSEC-2022-43092

The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

springframework: malicious input leads to insertion of additional log entries

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries...

CVE-2020-27784: Insertion of Sensitive Information Into Sent Data

A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printerioctl printerioctl tries to access of a printerdev instance. However, use-after-free arises because it had been freed by gprinterfree...

The vulnerability of the Calendar component in the Zimbra Collaboration Suite corporate email management system allows a hacker to insert any desired malicious code into documents.

The vulnerability of the Calendar component in the Zimbra Collaboration Suite enterprise email management system exists due to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to insert arbitrary code into documents...

CVE-2022-22411

IBM Spectrum Scale Data Access Services DAS 5.1.3.1 could allow an authenticated user to insert code which could allow the attacker to manipulate cluster resources due to excessive permissions. IBM X-Force ID: 223016...

CVE-2022-22411

IBM Spectrum Scale Data Access Services (DAS) 5.1.3.1 is affected. An authenticated user could insert code and manipulate cluster resources due to excessive service-account permissions. Affected product/version: DAS 5.1.3.1. Root cause described as risky permissions enabling code insertion. IBM b...

CVE-2022-33994

The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. NOTE: the XSS payload does not execute in the context of the WordPress instance's domain; however, analogous attempts by low-privileged users to...

Oracle WebLogic Server Core Component Input Validation Error Vulnerability

Oracle WebLogic Server is a product of Oracle Corporation. Oracle WebLogic Server is an application services middleware for cloud and traditional environments that provides a modern, lightweight development platform that supports the entire lifecycle management of applications from development to...

UBUNTU-CVE-2022-21539

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.29 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of th...

Fixed 7 CVEs in vim

CVE-2022-2206: adjust cmdlinerow and msgrow to the value of Rows - CVE-2022-2284: stop visual mode when closing a window - CVE-2022-2285: put a NUL after the typeahead - CVE-2022-2286: check the length of the string - CVE-2022-2287: disallow adding a word with control characters or a trailing...

Angular 跨站脚本漏洞

Angular is a development platform. It is used to build mobile and desktop web applications using Typescript / JavaScript and other languages. A cross-site scripting vulnerability exists in Angular, which stems from an insecure page cache in Internet Explorer that allows the insertion of textarea...

GSD-2022-1003929 netfilter: conntrack: re-fetch conntrack after insertion

netfilter: conntrack: re-fetch conntrack after insertion This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.246 by commit...

GSD-2022-1003813 netfilter: conntrack: re-fetch conntrack after insertion

netfilter: conntrack: re-fetch conntrack after insertion This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.197 by commit...

GSD-2022-1003656 netfilter: conntrack: re-fetch conntrack after insertion

netfilter: conntrack: re-fetch conntrack after insertion This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.120 by commit...

GSD-2022-1003453 netfilter: conntrack: re-fetch conntrack after insertion

netfilter: conntrack: re-fetch conntrack after insertion This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.45 by commit...

PT-2022-32076

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.197 Description The issue is related to netfilter: conntrack, where a re-fetch of conntrack after insertion is required. The actual impact and attack plausibility have not yet been proven. Recommendations Fo...

Download Manager < 3.2.48 - Contributor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the 'Insert URL' field, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks. Note: The attempted fix made in 3.2.46 and 3.2.47 were found to be insufficient As a contributor, create/edit a download and pu...

WordPress WP Simple Adsense Insertion plugin跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress WP Simple Adsense Insertion plugin prior to version 2.1 is vulnerable to cross-site request...

CVE-2022-1695

The WP Simple Adsense Insertion WordPress plugin before 2.1 does not perform CSRF checks on updates to its admin page, allowing an attacker to trick a logged in user to manipulate ads and inject arbitrary javascript via submitting a form...

CVE-2022-1695

The WP Simple Adsense Insertion WordPress plugin before 2.1 does not perform CSRF checks on updates to its admin page, allowing an attacker to trick a logged in user to manipulate ads and inject arbitrary javascript via submitting a form...