CVE-2020-23793

A flaw was found in spice-server in Redhat's VDI product that can restart KVMvirtual machine without any authorization. A handshake is required before spice-server and spice-client can establish communication, and spice-client will send a request containing information that the server needs. This...

Amazon Linux 2 : spice-protocol (ALAS-2023-2219)

The version of spice-protocol installed on the remote host is prior to 0.12.14-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2219 advisory. Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A...

Amazon Linux 2 : libgovirt (ALAS-2023-2220)

The version of libgovirt installed on the remote host is prior to 0.3.4-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2220 advisory. Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A...

CVE-2020-23793

An issue was discovered in spice-server spice-server-0.14.0-6.el76.1.x8664 of Redhat's VDI product. There is a security vulnerablility that can restart KVMvirtual machine without any authorization. It is not yet known if there will be other other effects...

DEBIAN-CVE-2020-23793

An issue was discovered in spice-server spice-server-0.14.0-6.el76.1.x8664 of Redhat's VDI product. There is a security vulnerablility that can restart KVMvirtual machine without any authorization. It is not yet known if there will be other other effects...

CVE-2020-23793

An issue was discovered in spice-server spice-server-0.14.0-6.el76.1.x8664 of Redhat's VDI product. There is a security vulnerablility that can restart KVMvirtual machine without any authorization. It is not yet known if there will be other other effects...

CVE-2020-23793

An issue was discovered in spice-server spice-server-0.14.0-6.el76.1.x8664 of Redhat's VDI product. There is a security vulnerablility that can restart KVMvirtual machine without any authorization. It is not yet known if there will be other other effects...

UBUNTU-CVE-2020-23793

An issue was discovered in spice-server spice-server-0.14.0-6.el76.1.x8664 of Redhat's VDI product. There is a security vulnerablility that can restart KVMvirtual machine without any authorization. It is not yet known if there will be other other effects...

CVE-2020-23793

An issue was discovered in spice-server spice-server-0.14.0-6.el76.1.x8664 of Redhat's VDI product. There is a security vulnerablility that can restart KVMvirtual machine without any authorization. It is not yet known if there will be other other effects...

PT-2023-11653 · Red Hat · Spice-Server

Name of the Vulnerable Software and Affected Versions: spice-server version 0.14.0-6.el7 6.1.x86 64 Description: A security issue was discovered in Redhat's VDI product, allowing a KVM virtual machine to be restarted without authorization. The full extent of the effects is not yet known...

spice 安全漏洞

spice is an adaptive telepresence open source protocol used by enterprise virtualized desktop editions. The product is primarily used to connect users to their virtual desktops and is capable of delivering the exact same end-user experience as a physical desktop. A security vulnerability exists i...

CVE-2020-23793

An issue was discovered in spice-server spice-server-0.14.0-6.el76.1.x8664 of Redhat's VDI product. There is a security vulnerablility that can restart KVMvirtual machine without any authorization. It is not yet known if there will be other other effects...

CVE-2020-23793

CVE-2020-23793 (Red Hat VDI spice-server) affects Red Hat VDI with spice-server-0.14.0-6.el7_6.1.x86_64. A handshake-flaw in spice-server allows restarting the KVM virtual machine without authorization by processing a malformed TCP packet; the advisory notes the vulnerability could have additiona...

WordPress Spice Blocks Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Spice Blocks Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID eed12859a044 Credits Rafie Muhammad Patchstack Required...

WordPress Spice Box Plugin < 2.2 is vulnerable to Cross Site Scripting (XSS)

Software Spice Box Type Plugin Vulnerable versions 2.2 Fixed in 2.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1d9a54925819 Credits Rafie Muhammad Patchstack Required privilege...

WordPress Spice Post Slider Plugin <= 1.9 is vulnerable to Cross Site Scripting (XSS)

Software Spice Post Slider Type Plugin Vulnerable versions = 1.9 Fixed in 2.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6d34a32da46f Credits Rafie Muhammad Patchstack Required...

WordPress Spice Starter Sites Plugin < 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Spice Starter Sites Type Plugin Vulnerable versions 1.1 Fixed in 1.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9401fa99b65e Credits Rafie Muhammad Patchstack Required...

CVE-2023-27439

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in glSPICE New Adman plugin = 1.6.8 versions...

PT-2023-21127 · Unknown · Gl Spice New Adman Plugin

Name of the Vulnerable Software and Affected Versions: gl SPICE New Adman plugin versions 1.6.8 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For gl SPICE New Adman plugin...

spice-tv.jp Cross Site Scripting vulnerability OBB-3390845

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...