CVE-2022-1292

A flaw was found in OpenSSL. The crehash script does not properly sanitize shell meta-characters to prevent command injection. Some operating systems distribute this script in a manner where it is automatically executed. This flaw allows an attacker to execute arbitrary commands with the privileg...

WordPress WP Meta SEO plugin <= 4.4.6 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Victor Pasman in WordPress WP Meta SEO plugin versions = 4.4.6. Solution Update the WordPress WP Meta SEO plugin to the latest available version at least 4.4.7...

WP Meta SEO < 4.4.7 - Admin+ Stored Cross-Site Scripting via breadcrumbs

The plugin does not sanitise or escape the breadcrumb separator before outputting it to the page, allowing a high privilege user such as an administrator to inject arbitrary javascript into the page even when unfiltered html is disallowed. As admin, put the following payload in the Breadcrumb...

Lyon Bros Turtlapp Turtle Note Cross-site Scripting Vulnerability

Lyon Bros Turtlapp Turtle Note is a secure, collaborative notebook from Lyon Bros. Use it to save notes, bookmarks, passwords, ideas, dream journals, photos, documents and anything else you want to keep safe. A security vulnerability exists in Turtlapp Turtle Note version v0.7.2.6, which stems fr...

PT-2022-18809

Name of the Vulnerable Software and Affected Versions Turtlapp Turtle Note version 0.7.2.6 Description The issue allows attackers to execute HTML injection due to the lack of filtering of the tag during markdown parsing. Recommendations For version 0.7.2.6, as a temporary workaround, consider...

python-suds bug fix and enhancement update

The suds project is a python soap web services client lib. Suds leverages python meta programming to provide an intuitive API for consuming web services. Objectification of types defined in the WSDL is provided without class generation. Programmers rarely need to read the WSDL since services and...

CVE-2022-0693

The Master Elements WordPress plugin through 8.0 does not validate and escape the metaids parameter of its removepostmetacondition AJAX action available to both unauthenticated and authenticated users before using it in a SQL statement, leading to an unauthenticated SQL Injection...

CVE-2022-0693

The Master Elements WordPress plugin through 8.0 does not validate and escape the metaids parameter of its removepostmetacondition AJAX action available to both unauthenticated and authenticated users before using it in a SQL statement, leading to an unauthenticated SQL Injection...

PT-2022-13365

Name of the Vulnerable Software and Affected Versions Master Elements WordPress plugin versions prior to 8.0 Description The issue concerns the Master Elements WordPress plugin, which does not properly validate and escape the meta ids parameter of its remove post meta condition AJAX action. This...

WordPress plugin Master Elements has a SQL injection vulnerability.

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin Master Elements 8.0 and earlier versions are vulnerable to SQL injection, which stems from t...

PHP stream_get_meta_data Data Compromise

The vulnerability of the streamgetmetadata function in the PHP programming language exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise the integrity of information...

Fedora: Security Advisory for kernel (FEDORA-2022-8efcea6e67)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

PortSwigger Web Security: Redirection in Repeater & Intruder Tab

This was a bug in Repeater/Intruder whereby a meta redirect would be followed when a user clicked the follow redirection button regardless of the content type or content disposition headers used on the target web site. This could disclose the referrer header. It was considered a low severity issu...

Fedora: Security Advisory for kernel (FEDORA-2022-5cd9d787dc)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 35 Update: kernel-5.16.19-200.fc35

The kernel meta package...

CVE-2022-27823

Improper size check in sapefdparsemetaHEADERold function of libsapeextractor library prior to SMR Apr-2022 Release 1 allows out of bounds read via a crafted media file...

[SECURITY] Fedora 36 Update: kernel-5.17.2-300.fc36

The kernel meta package...

PT-2022-18613

Name of the Vulnerable Software and Affected Versions libsapeextractor library versions prior to SMR Apr-2022 Release 1 Description The issue is related to an improper size check in the sapefd parse meta HEADER function, which allows for an out of bounds read. This can be triggered by a crafted...

Samsung SMR buffer error vulnerability

Samsung SMR is a system patch package from South Korea's Samsung Samsung. It provides patches for Samsung mobile applications. Samsung SMR suffers from a buffer overflow vulnerability that stems from incorrect size checking of the in-sapefdparsemetaDESCRIPTION function of the libsapeextractor...

PT-2022-18612

Name of the Vulnerable Software and Affected Versions libsapeextractor library versions prior to SMR Apr-2022 Release 1 Description The issue is related to an improper size check in the sapefd parse meta DESCRIPTION function, which allows for an out of bounds read via a crafted media file...