SUSE CVE-2022-34037

An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service DoS via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an...

SUSE CVE-2022-41946

pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either PreparedStatement.setTextint, InputStream or PreparedStatemet.setByteaint, InputStream will create a temporary file if the InputStream is larger than 2k. This will create a temporary file which...

PT-2023-13366 · Dell · Bsafe Ssl-J

Name of the Vulnerable Software and Affected Versions: Dell BSAFE SSL-J versions prior to 6.5 Dell BSAFE SSL-J version 7.0 Description: The issue is related to a debug message that reveals unnecessary information, potentially leading to the disclosure of sensitive information to a locally...

ChurchCRM SQL注入漏洞

ChurchCRM is an open source CRM system for churches. A security vulnerability exists in ChurchCRM v4.5.3 and earlier versions that stems from the presence of a SQL injection vulnerability via the EID parameter in GetText.php...

CVE-2022-29416

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Afterpay Gateway for WooCommerce = 3.5.0 versions...

Kodi Home Theater Software 缓冲区错误漏洞

Kodi Home Theater Software is an award-winning free and open source GPL software media player and digital media entertainment center from the individual developer Peter Frühberger. A security vulnerability exists in Kodi Home Theater Software version 19.5 that originates from a denial of service...

Mercurius 安全漏洞

Mercurius is a GraphQL adapter Fastify. A security vulnerability exists in Mercurius versions prior to 10.5.0, which is caused by a denial of service attack when any user sends an incorrectly formatted packet to "/graphql" via WebSocket...

PT-2023-12293 · Tasmota · Tasmota

Name of the Vulnerable Software and Affected Versions: Tasmota firmware version 6.5.0 Description: The issue allows remote attackers to inject JavaScript code via a crafted string in the Friendly Name 1 field. This enables Cross Site Scripting XSS attacks. Recommendations: For Tasmota firmware...

WordPress plugin Custom Field Template 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in the...

PT-2022-28013 · WordPress · Profilepress

Name of the Vulnerable Software and Affected Versions: ProfilePress plugin for WordPress versions up to, and including, 4.5.0 Description: The issue is related to Stored Cross-Site Scripting via the wp user cover default image url parameter due to insufficient input sanitization and output...

PT-2022-16062

Name of the Vulnerable Software and Affected Versions jsonwebtoken versions = 8.5.1 Description The jsonwebtoken library can be misconfigured, leading to incorrect verification of tokens. This occurs when a poorly implemented key retrieval function is used, referring to the secretOrPublicKey...

NdkAdvancedCustomizationFields 跨站脚本漏洞

NdkAdvancedCustomizationFields is an advanced customization field from Ndk. A security vulnerability exists in NdkAdvancedCustomizationFields version v3.5.0, which originates from Cross-Site Scripting XSS and allows attackers to execute arbitrary web script or HTML via a crafted payload injected...

CVE-2022-42362

Adobe Experience Manager version 6.5.14 and earlier is affected by a reflected Cross-Site Scripting XSS vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the...

CVE-2022-42352

Adobe Experience Manager version 6.5.14 and earlier is affected by a reflected Cross-Site Scripting XSS vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the...

CVE-2022-44236

Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 20181130-16:12 has a Weak password vulnerability...

CVE-2022-32948

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to execute arbitrary code with kernel privileges...

PT-2022-5954 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.14 and earlier Description: The issue exists due to inadequate protection of the web page structure. An attacker, acting remotely, can exploit this to perform cross-site scripting attacks using a speciall...

PT-2022-5961 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.14 and earlier Description: The issue exists due to inadequate protection of the web page structure in Adobe Experience Manager, allowing a remote attacker to perform cross-site scripting attacks using a...

CVE-2022-44790

Interspire Email Marketer through 6.5.1 allows SQL Injection via the surveys module. An unauthenticated attacker could successfully perform an attack to extract potentially sensitive information from the database if the survey id exists...

Akeneo PIM Development Repository 代码注入漏洞

Akeneo PIM Development Repository is an Akeneo open source repository . It is used to develop Akeneo PIM products. A code injection vulnerability exists in Akeneo PIM Development Repository versions prior to v5.0.119 and v6.0.53, which originates from a code injection vulnerability that could all...