PT-2024-24333 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 3.0.1 through 4.10.19 XWiki Platform versions 14.10.19 and earlier XWiki Platform versions 15.5.3 and earlier XWiki Platform versions prior to 15.10-rc-1 Description: XWiki Platform is a generic wiki platform. Remote...

PT-2023-8800

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.0-rc4+ Description The issue is related to a use-after-free UAF vulnerability in the cifs demultiplex thread function. This vulnerability can be exploited by an attacker to potentially execute arbitrary code...

CVE-2023-35666

In btaavrcmsg of btaavact.cc, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2023-25254 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a possible use after free due to a logic error in the code, specifically in bta av rc msg of bta av act.cc. This could lead to...

rc-monster.com Cross Site Scripting vulnerability OBB-3654108

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

XWiki 7.2 < 14.10.10, 15.0-rc-1 < 15.4 Code Injection Vulnerability (GHSA-m5m2-h6h9-p2c8)

XWiki is prone to a code injection vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescription...

CVE-2022-44349

NAVBLUE S.A.S N-Ops & Crew 22.5-rc.50 is vulnerable to Cross Site Scripting XSS...

CVE-2022-44349

NAVBLUE S.A.S N-Ops & Crew 22.5-rc.50 is vulnerable to Cross Site Scripting XSS...

CVE-2022-44349

NAVBLUE S.A.S N-Ops & Crew 22.5-rc.50 is vulnerable to Cross Site Scripting XSS...

PT-2023-14454 · Navblue S.A.S · Navblue N-Ops & Crew

Name of the Vulnerable Software and Affected Versions: NAVBLUE S.A.S N-Ops & Crew version 22.5-rc.50 Description: The issue is related to Cross Site Scripting XSS, which is a type of security vulnerability that can allow an attacker to inject malicious scripts into a website. No information is...

CVE-2022-44349

CVE-2022-44349 affects NAVBLUE S.A.S N-Ops & Crew 22.5-rc.50. The vulnerability is described as Cross Site Scripting (XSS) in multiple sources. Root cause, affected components, and exact exploit details are not provided in the documents. Some connected sources (CNNVD) claim exploitation; however,...

XWiki 4.0-milestone-2 < 13.10.11, 14.0-rc-1 < 14.4.8, 14.5 < 14.10.1 XSS Vulnerability (GHSA-44h9-xxvx-pg6x)

Xwiki is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

XWiki 8.0-rc-1 < 14.10.1 Improper Access Control Vulnerability (GHSA-fp36-mjw5-fmgx)

Xwiki is prone to an improper access control vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

Malicious code in zustand-rc.1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f36f860dc8e345626951d6e9c0b4c8798cb5b2ef0abd7e199f44840e71831a68 The OpenSSF Package Analysis project identified 'zustand-rc.1' @ 1.999.9 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1449 Malicious code in zustand-rc.1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f36f860dc8e345626951d6e9c0b4c8798cb5b2ef0abd7e199f44840e71831a68 The OpenSSF Package Analysis project identified 'zustand-rc.1' @ 1.999.9 npm as malicious. It is considered malicious because: - The package...

Intel(R) SSD Security Vulnerability

IntelR SSD is a solid state drive from Intel Corporation USA. A security vulnerability exists in versions prior to IntelR SSD Tools mdadm-4.2-rc2. An attacker can exploit the vulnerability to elevate privileges...

GHSA-6R78-M64M-QWCF Moq v4.20.0-rc to 4.20.1 share hashed user data

Moq v4.20.0-rc to 4.20.1 include support for SponsorLink, which runs an obfuscated DLL at build time that scans local git config data and shares the user's hashed email address with SponsorLink's remote servers. There is no option to disable this. Moq v4.20.2 has removed this functionality...

Moq v4.20.0-rc to 4.20.1 share hashed user data

Moq v4.20.0-rc to 4.20.1 include support for SponsorLink, which runs an obfuscated DLL at build time that scans local git config data and shares the user's hashed email address with SponsorLink's remote servers. There is no option to disable this. Moq v4.20.2 has removed this functionality...

Allocation of Resources Without Limits or Throttling

Overview std/crypto/tls is a Go standard library package std/crypto/tls Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. Go Vulnerability Report: via the crypto/tls process. An attacker can cause excessive CPU consumption by presenting...

Obfuscated email addresses should not be sorted

Impact The mail obfuscation configuration was not fully taken into account and is was still possible by obfuscated emails. See https://jira.xwiki.org/browse/XWIKI-20601 for the reproduction steps. Patches This has been patched in XWiki 14.10.9, and XWiki 15.3-rc-1. Workarounds The workaround is t...