SUSE CVE-2022-27416

Tcpreplay v4.4.1 was discovered to contain a double-free via interceptorfree...

SUSE CVE-2022-31650

In SoX 14.4.2, there is a floating-point exception in lsxaiffstartwrite in aiff.c in libsox.a...

WordPress plugin Youtube Channel Gallery 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

PT-2023-1609 · Ibm · Ibm Aspera Faspex

Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex versions 4.4.2 Patch Level 1 and earlier Description: The issue is related to a YAML deserialization flaw, allowing a remote attacker to execute arbitrary code on the system by sending a specially crafted obsolete API call...

USN-4781-2 slurm-llnl vulnerabilities

USN-4781-1 fixed several vulnerabilities in Slurm. This update provides the corresponding updates for Ubuntu 14.04 ESM CVE-2016-10030 and Ubuntu 16.04 ESM CVE-2018-10995. Original advisory details: It was discovered that Slurm incorrectly handled certain messages between the daemon and the user. ...

CVE-2022-4781 Accordion Shortcodes <= 2.4.2 - Contributor+ Stored XSS via Shortcode

The Accordion Shortcodes WordPress plugin through 2.4.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack...

PYSEC-2023-31

Cross-site Scripting XSS - Stored in GitHub repository modoboa/modoboa prior to 2.0.4...

PT-2023-19604 · Jenkins · Jenkins Openid Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins OpenID Plugin versions 2.4 and earlier Description: The issue arises because the plugin does not invalidate the previous session on login. Recommendations: For Jenkins OpenID Plugin versions 2.4 and earlier, update to a version later...

PT-2023-19606 · Jenkins · Jenkins Openid Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins OpenID Plugin versions 2.4 and earlier Description: A cross-site request forgery issue allows attackers to trick users into logging in to the attacker's account. Recommendations: For Jenkins OpenID Plugin versions 2.4 and earlier,...

WordPress plugin Sitemap 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

PT-2023-1111 · Adobe · Indesign

Name of the Vulnerable Software and Affected Versions: Adobe InDesign versions 18.0 and earlier Adobe InDesign versions 17.4 and earlier Description: The issue is related to insufficient input validation in Adobe InDesign, which could allow an attacker to execute arbitrary code. Exploitation of...

Nagios 跨站脚本漏洞

Nagios is an open source, free network monitoring tool from Nagios, Inc. A cross-site scripting vulnerability exists in Nagios NCPA versions prior to 2.4.0, which stems from unknown code in the file agent/listener/templates/tail.html, where manipulation of parameter names results in cross-site...

Contec CONPROSYS HMI System 操作系统命令注入漏洞

Contec CONPROSYS HMI System is an HTML5-based HMI Human Machine Interface/SCADA Supervisory Control and Data Acquisition software product from Contec Japan. A security vulnerability exists in Contec CONPROSYS HMI System CHS Ver.3.4.4 and earlier versions, which is rooted in susceptibility to an O...

PT-2022-36381 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.225 Description: The issue is related to the 9p/trans fd functionality, where it does not always use O NONBLOCK for read/write operations. The actual impact and potential for attack have not been proven yet...

UBUNTU-CVE-2022-39277

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. External links are not properly sanitized and can therefore be used for a Cross-Site Scripting XSS...

PT-2022-7398 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.4 Description: The issue is related to the lack of proper sanitization of external links, which can be used for a Cross-Site Scripting XSS attack. This allows a remote attacker to exploit the vulnerability...

CVE-2022-43361

Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting XSS vulnerability via the component popchart.php...

Microsoft Azure 操作系统命令注入漏洞

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from Microsoft Corporation USA. An operating system command injection vulnerability exists in Microsoft Azure CLI versions prior to 2.40.0, which originates from a host running Azure CLI commands where the parameter...

AZL-11283 CVE-2022-3570 affecting package libtiff for versions less than 4.4.0-5

Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A security vulnerability exists in GitLab CE/EE versions 12.8 through 15.2.5,...