13099 matches found
Arbitrary Code Execution
XMP Toolkit is vulnerable to arbitrary code execution. The vulnerability exists because of a memory corruption which allows an attacker to inject and execute arbitrary codes...
ALBA-2022:2119 libsemanage bug fix and enhancement update
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...
RLSA-2022:1861 Moderate: maven:3.5 security update
Maven is a software project management and comprehension tool. Based on the concept of a project object model POM, Maven can manage a project's build, reporting and documentation from a central piece of information. Security Fixes: apache-httpclient: incorrect handling of malformed authority...
Moderate: qt5-qtbase security update
Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fixes: qt: out-of-bounds write in QOutlineMapper::convertPath called from QRasterPaintEngine::fill and QPaintEngineEx::stroke CVE-2021-38593 For mor...
ALBA-2022:2025 nfs-utils bug fix and enhancement update
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...
DLA-2996-1 mruby - security update
Bulletin has no description...
CVE-2021-38443
Eclipse CycloneDDS versions prior to 0.8.0 improperly handle invalid structures, which may allow an attacker to write arbitrary values in the XML parser...
CVE-2022-28859
CVE-2022-28859 affects F5 BIG-IP: during Net HSM installation, the scripts nethsm-safenet-install.sh and nethsm-thales-install.sh expose the Net HSM partition password. Public docs confirm affected versions include 14.1.x prior to 14.1.4.6, 15.1.x prior to 15.1.5.1, and 16.x prior to 16.1.0 (with...
GHSA-WFG2-2WMW-6894 MantisBT vulnerable to XSS via unescaped output in browser_search_plugin.php
An XSS issue was discovered in browsersearchplugin.php in MantisBT up to and including 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field...
PT-2022-18157 · Foxit · Foxit Pdf Reader +1
Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader versions prior to 12.0.1 Foxit PDF Editor versions prior to 12.0.1 Description: The issue allows a NULL pointer dereference when this.Span is used for oState of Collab.addStateModel, because this.Span.text can be NULL...
Command Injection
git-pull-or-clone is vulnerable to command injection. A remote attacker is able to inject malicious command-line arguments to be executed on the OS through the gitClone function via the --upload-pack feature of git...
GHSA-HWRC-W5GG-F335 TYPO3 Install Tool Subcomponent Allows Access Using Only a Password's MD5 Hash as a Credential
The Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to gain access by using only the password's md5 hash as a credential...
GHSA-8XQM-3QM5-QHFV Joomla! allows attackers to access cached pages
The file caching implementation in Joomla! before 1.5.4 allows attackers to access cached pages via unknown attack vectors...
GHSA-775G-4482-PM94 MoinMoin Multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting XSS vulnerabilities in action/AttachFile.py in MoinMoin 1.5.8 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 message, 2 pagename, and 3 target filenames. The issue was fixed on db212dfc58ef...
GHSA-76X8-GG39-5JJG CherryPy Malicious cookies allow access to files outside the session directory
Directory traversal vulnerability in the getfilepath function in 1 lib/sessions.py in CherryPy 3.0.x up to 3.0.2, 2 filter/sessionfilter.py in CherryPy 2.1, and 3 filter/sessionfilter.py in CherryPy 2.x allows remote attackers to create or delete arbitrary files, and possibly read and write...
GHSA-M84W-VGWF-P893 MoinMoin Multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting XSS vulnerabilities in MoinMoin before 1.5.7 allow remote attackers to inject arbitrary web script or HTML via 1 the page info, or the page name in a 2 AttachFile, 3 RenamePage, or 4 LocalSiteMap action...
GHSA-R7J4-82XW-8M9P Plone allows a user to masquerade as a group
Unspecified vulnerability in PlonePAS in Plone 2.5 and 2.5.1, when anonymous member registration is enabled, allows an attacker to "masquerade as a group."...
ASB-A-223071150
In ion, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...