CVE-2023-28629: Improper Neutralization of Input During Web Page Generation

GoCD is an open source continuous delivery server. GoCD versions before 23.1.0 are vulnerable to a stored XSS vulnerability, where pipeline configuration with a malicious pipeline label configuration can affect browser display of pipeline runs generated from that configuration. An attacker that h...

Nginx alias path traversal allows unauthenticated attackers to read all files on /label_studio/core/

Summary The vulnerability resides on the Nginx config file: https://github.com/heartexlabs/label-studio/blob/53944e6bcede75ca5c102d655013f2e5238e85e6/deploy/default.confL119 The pattern on location /static indicates a popular misconfiguration on Nginx servers presented in 2018 originally by Orang...

Qibosoft QiboCMS SQL注入漏洞

Qibosoft QiboCMS is an application software of China Qibo Software Qibosoft Company. A website builder CMS. A security vulnerability exists in Qibosoft QiboCMS v7, which originates from the GetTitle function in labelsetrs.php contains a Remote Code Execution RCE vulnerability...

Cross-site Scripting (XSS)

craftcms/cms is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to improper validation of url parameters in label names or instruction of an entry type located in parameter.js, which allows an attacker to inject and execute malicious JavaScript in the victims browser...

The vulnerability of the MPLS (Multiprotocol Label Switching) kernel in Linux operating systems allows attackers to compromise the confidentiality, integrity, and accessibility of data.

The vulnerability of the MPLS Multi-Protocol Label Switching kernel in Linux operating systems is related to a memory reclamation error. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of data...

SUSE CVE-2023-26545

In the Linux kernel before 6.1.13, there is a double free in net/mpls/afmpls.c upon an allocation failure for registering the sysctl table under a new location during the renaming of a device...

K16866: PowerDNS vulnerabilities CVE-2014-8601 and CVE-2015-1868

Security Advisory Description CVE-2014-8601 PowerDNS Recursor before 3.6.2 does not limit delegation chaining, which allows remote attackers to cause a denial of service "performance degradations" via a large or infinite number of referrals, as demonstrated by resolving domains hosted by ezdns.it...

K29154575: ImageMagick vulnerability CVE-2016-3717

Security Advisory Description The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image. CVE-2016-3717 Note : This vulnerability is one of the series of vulnerabilities known as ImageTragick. Impact Exploiting this...

SUSE CVE-2005-0038

The DNS implementation of PowerDNS 2.9.16 and earlier allows remote attackers to cause a denial of service via a compressed DNS packet with a label length byte with an incorrect offset, which could trigger an infinite loop...

SUSE CVE-2005-1279

tcpdump 3.8.3 and earlier allows remote attackers to cause a denial of service infinite loop via a crafted 1 BGP packet, which is not properly handled by RTROUTINGINFO, or 2 LDP packet, which is not properly handled by the ldpprint function...

SUSE CVE-2005-3806

The IPv6 flow label handling code ip6flowlabel.c in Linux kernels 2.4 up to 2.4.32 and 2.6 before 2.6.14 modifies the wrong variable in certain circumstances, which allows local users to corrupt kernel memory or cause a denial of service crash by triggering a free of non-allocated memory...

SUSE CVE-2006-6870

The consumelabels function in avahi-core/dns.c in Avahi before 0.6.16 allows remote attackers to cause a denial of service infinite loop via a crafted compressed DNS response with a label that points to itself...

SUSE CVE-2007-3511

The focus handling for the onkeydown event in Mozilla Firefox 1.5.0.12, 2.0.0.4 and other versions before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to change field focus and copy keystrokes via the "for" attribute in a label, which bypasses the focus prevention, as demonstrated ...

SUSE CVE-2008-2326

mDNSResponder in the Bonjour Namespace Provider in Apple Bonjour for Windows before 1.0.5 allows attackers to cause a denial of service NULL pointer dereference and application crash by resolving a crafted .local domain name that contains a long label...

SUSE CVE-2008-3687

Heap-based buffer overflow in the flasksecuritylabel function in Xen 3.3, when compiled with the XSM:FLASK module, allows unprivileged domain users domU to execute arbitrary code via the flaskop hypercall...

SUSE CVE-2008-3972

pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card's label matches the "OpenSC" string, which might allow physically proximate attackers to exploit vulnerabilities that the card owner expected were patched, as demonstrated by exploitation of...

SUSE CVE-2010-1645

Cacti before 0.8.7f, as used in Red Hat High Performance Computing HPC Solution and other products, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in 1 the FQDN field of a Device or 2 the Vertical Label field of a Graph Template...

SUSE CVE-2011-3601

Buffer overflow in the processra function in the router advertisement daemon radvd before 1.8.2 allows remote attackers to execute arbitrary code or cause a denial of service crash via a negative value in a labellen value...

SUSE CVE-2012-5240

Buffer overflow in the dissecttlv function in epan/dissectors/packet-ldp.c in the LDP dissector in Wireshark 1.8.x before 1.8.3 allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a malformed packet...

SUSE CVE-2013-1578

The dissectpwethheuristic function in epan/dissectors/packet-pw-eth.c in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle apparent Ethernet address values at the beginning of MPLS data, which allows remote attackers to cause a denial of service loop via a malformed...