CVE-2021-32859 Baremetrics date range picker vulnerable to Cross-site Scripting

The Baremetrics date range picker is a solution for selecting both date ranges and single dates from a single calender view. Versions 1.0.14 and prior are prone to cross-site scripting XSS when handling untrusted placeholder entries. An attacker who is able to influence the field placeholder when...

CVE-2022-40231

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 could allow an authenticated user to perform unauthorized actions due to improper access controls. IBM X-Force ID: 235533...

8x8 Bounty: connect.8x8.com: Too much resource consumption of the server due to incorrect date range control via /api/v1/reports?dateFrom=

The server of connect.8x8.com was vulnerable to excessive resource consumption due to incorrect date range control via the /api/v1/reports endpoint. Attackers could cause the server to crash by repeatedly increasing the date range, potentially leading to a DoS attack. The vulnerability has since...

CVE-2022-33869

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the management interface of FortiWAN 4.0.0 through 4.5.9 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...

@accounter-toolkit/green-invoice-graphql (>=0.0.2-alpha-20220914223128-d706aab, <=0.2.0-alpha-20230313141007-4bdbab6), @accounter-toolkit/hashavshevet-mesh (>=0.0.2-alpha-20220915073207-1bb0680, <=0.0.4-alpha-20230313141007-4bdbab6) +10 more potentially affected by CVE-2025-27098 via @graphql-mesh/cli (>=0.78.0, <=0.82.21)

@graphql-mesh/cli NPM version =0.78.0, =0.0.2-alpha-20220914223128-d706aab, =0.0.2-alpha-20220915073207-1bb0680, =0.0.2-alpha-20220914223128-d706aab, =0.2.0-alpha.24, =5.1.0-canary.3, =6.0.0-canary.20, =6.0.0-canary.20, =6.0.0-canary.20, =2.2.6-alpha-20220906004558-09c8599,...

@24hr/content-next (>=1.0.0, <=2.1.17-alpha), @24hr/natswrapper (>=1.0.0, <=1.0.20) +274 more potentially affected by CVE-2023-22580 via sequelize (>=6.0.0-beta.4, <=6.28.0)

sequelize NPM version =6.0.0-beta.4, =1.0.0, =1.0.0, =0.1.0, =0.8.0, =1.0.0, =1.0.43, =0.13.0, =5.0.0-alpha.3, =13.0.7-feature-244b53-kvkvw2nk, =1.0.63, =0.1.3-alpha.0, =0.1.3-alpha.0, =0.3.2 and more Source cves: CVE-2023-22580 Source advisory: OSV:GHSA-8C25-F3MJ-V6H8...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Go Text vulnerabilities (USN-5873-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5873-1 advisory. It was discovered that Go Text incorrectly handled certain encodings. An attacker could possibly use this issue to cause a denial...

SUSE CVE-2004-0110

Buffer overflow in the 1 nanohttp or 2 nanoftp modules in XMLSoft Libxml 2 Libxml2 2.6.0 through 2.6.5 allow remote attackers to execute arbitrary code via a long URL...

SUSE CVE-2004-1139

Unknown vulnerability in the DICOM dissector in Ethereal 0.10.4 through 0.10.7 allows remote attackers to cause a denial of service application crash...

SUSE CVE-2004-1141

The HTTP dissector in Ethereal 0.10.1 through 0.10.7 allows remote attackers to cause a denial of service application crash via a certain packet that causes the dissector to access previously-freed memory...

SUSE CVE-2005-2728

The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service memory consumption via an HTTP header with a large Range field...

SUSE CVE-2005-3191

Multiple heap-based buffer overflows in the 1 DCTStream::readProgressiveSOF and 2 DCTStream::readBaselineSOF functions in the DCT stream parsing code Stream.cc in xpdf 3.01 and earlier, as used in products such as a Poppler, b teTeX, c KDE kpdf, d pdftohtml, e KOffice KWord, f CUPS, and g...

SUSE CVE-2005-3192

Heap-based buffer overflow in the StreamPredictor function in Xpdf 3.01, as used in products such as 1 Poppler, 2 teTeX, 3 KDE kpdf, and 4 pdftohtml, 5 KOffice KWord, 6 CUPS, and 7 libextractor allows remote attackers to execute arbitrary code via a PDF file with an out-of-range numComps number o...

SUSE CVE-2005-3808

Integer overflow in the invalidateinodepages2range function in mm/truncate.c in Linux kernel 2.6.11 to 2.6.14 allows local users to cause a denial of service hang via 64-bit mmap calls that are not properly handled on a 32-bit system...

SUSE CVE-2006-2449

KDE Display Manager KDM in KDE 3.2.0 up to 3.5.3 allows local users to read arbitrary files via a symlink attack related to the session type for login...

SUSE CVE-2006-6660

The nodeType function in KDE libkhtml 4.2.0 and earlier, as used by Konquerer, KMail, and other programs, allows remote attackers to cause a denial of service crash via malformed HTML tags, possibly involving a COL SPAN tag embedded in a RANGE tag...

SUSE CVE-2007-3642

The decodechoice function in net/netfilter/nfconntrackh323asn1.c in the Linux kernel before 2.6.20.15, 2.6.21.x before 2.6.21.6, and before 2.6.22 allows remote attackers to cause a denial of service crash via an encoded, out-of-range index value for a choice field, which triggers a NULL pointer...

SUSE CVE-2007-4568

Integer overflow in the buildrange function in X.Org X Font Server xfs before 1.0.5 allows context-dependent attackers to execute arbitrary code via 1 QueryXBitmaps and 2 QueryXExtents protocol requests with crafted size values, which triggers a heap-based buffer overflow...

SUSE CVE-2007-6451

Unspecified vulnerability in the CIP dissector in Wireshark formerly Ethereal 0.9.14 to 0.99.6 allows remote attackers to cause a denial of service crash via unknown vectors that trigger allocation of large amounts of memory...

SUSE CVE-2008-0007

Linux kernel before 2.6.22.17, when using certain drivers that register a fault handler that does not perform range checks, allows local users to access kernel memory via an out-of-range offset...