CVE-2023-22454

Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 3.0.0.beta16 on the beta and tests-passed branches, pending post titles can be used for cross-site scripting attacks. Pending posts can be created by unprivileged users when a category has...

Cross site scripting

Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 3.0.0.beta16 on the beta and tests-passed branches, pending post titles can be used for cross-site scripting attacks. Pending posts can be created by unprivileged users when a category has...

CVE-2023-22454 Discourse vulnerable to Cross-site Scripting through pending post titles descriptions

Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 3.0.0.beta16 on the beta and tests-passed branches, pending post titles can be used for cross-site scripting attacks. Pending posts can be created by unprivileged users when a category has...

CVE-2023-22454 Discourse vulnerable to Cross-site Scripting through pending post titles descriptions

Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 3.0.0.beta16 on the beta and tests-passed branches, pending post titles can be used for cross-site scripting attacks. Pending posts can be created by unprivileged users when a category has...

Discourse 跨站脚本漏洞

Discourse is an open source community discussion platform. The platform includes community, email and chat room features. Discourse suffers from a cross-site scripting vulnerability that stems from its pending post titles allowing an attacker to implement cross-site scripting. When a category has...

PT-2023-18510 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.8.14 on the stable branch Discourse versions prior to 3.0.0.beta16 on the beta and tests-passed branches Description: The issue concerns a cross-site scripting attack through pending post titles, which can be...

PT-2022-7636 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a use-after-free vulnerability in the Linux kernel's dmaengine subsystem, specifically in the idxd driver. When the driver is unloaded, any pending descriptors...

PT-2022-25572 · Unknown · Ndkadvancedcustomizationfields

Name of the Vulnerable Software and Affected Versions: NdkAdvancedCustomizationFields version 3.5.0 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via crafted payloads injected into the htmlNodes parameter. This enables attackers to...

PT-2022-7382 · Ibm · Ibm Security Verify Governance

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Governance, Identity Manager version 10.0.1 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within...

Might lose manager forever

Lines of code Vulnerability details Impact If project sets new manager with a typo, might lose manager forever Proof of Concept function setManager address manager public onlyOwner manager = manager; https://twitter.com/realgmhacker/status/1603362870699429889?s=20&t=vm4wY1ITefLhCW8BDa0oig...

PT-2022-27729 · Unknown · Helmet Store Showroom

Name of the Vulnerable Software and Affected Versions: Helmet Store Showroom version 1.0 Description: The issue is related to a SQL Injection vulnerability at the Login Page. This vulnerability can be exploited to bypass admin access. Recommendations: For Helmet Store Showroom version 1.0, consid...

Google Pixel 安全漏洞

Google Pixel is a smartphone from the American company Google Google. Google Pixel has a security vulnerability. No information about this vulnerability is available at this time, so stay tuned to CNNVD or the manufacturer's announcement...

Google Pixel 缓冲区错误漏洞

Google Pixel is a smartphone from the American company Google Google. Google Pixel has a security vulnerability. No information about this vulnerability is available at this time, so stay tuned to CNNVD or the manufacturer's announcement...

PT-2022-27353 · Webtareas · Webtareas

Name of the Vulnerable Software and Affected Versions: webtareas version 2.4p5 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field after clicking "Add" in the "/linkedcontent/listfiles.php" component. This enables the...

PT-2022-27195 · Tenda · Tenda I21

Name of the Vulnerable Software and Affected Versions: Tenda i21 version 1.0.0.144656 Description: The issue is related to a Buffer Overflow that can be triggered via the /goform/setSnmpInfo API endpoint. This allows for potential exploitation. Recommendations: For Tenda i21 version 1.0.0.144656,...

PT-2022-7676 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the perf pending task function in the Linux kernel, which can lead to a use-after-free condition. This occurs when perf pending task runs after the event is...

1sticker.ru Cross Site Scripting vulnerability OBB-3072529

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-45844

CVE-2022-45844 is associated with a Broken Access Control vulnerability in the WordPress Organization Chart plugin prior to version 1.4.2. The Patchstack entry specifies that versions ≤ 1.4.1 are affected, with remediation by updating to at least 1.4.2. No exploitation details are provided in the...

PT-2022-27121 · Jizhicms · Jizhicms

Name of the Vulnerable Software and Affected Versions: Jizhicms version 2.3.3 Description: A SQL injection issue was found in the /Member/memberedit.html component. This allows for potential exploitation via SQL injection attacks. Recommendations: For Jizhicms version 2.3.3, consider restricting...

kernel: netfilter: flowtable: fix stuck flows on cleanup due to pending work

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix stuck flows on cleanup due to pending work To clear the flow table on flow table free, the following sequence normally happens in order: 1 gcstep work is stopped to disable any further stats/del requests...