Transtek Mojodat FAM SQL注入漏洞

Transtek Mojodat FAM is a Fixed Asset Management software from Transtek Lebanon. A security vulnerability exists in Transtek Mojodat FAM Fixed Asset Management version 2.4.6, which stems from a vulnerability that allows remote attackers to send SCRIPT tags as injected input to API requests...

CVE-2022-36859

Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.21-6 allows privileged attackers to trigger a XSS on a victim's devices...

CVE-2022-36859

Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.21-6 allows privileged attackers to trigger a XSS on a victim's devices...

OESA-2022-1904 sudo security update

Sudo is a program designed to allow a sysadmin to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow people to get their work done. Security Fixes: Protobuf-c v1.4.0 was discovered to contain an invalid...

The vulnerability in the web interface of the Cisco IoT Control Center allows a perpetrator to execute arbitrary code or access confidential information.

The vulnerability in the web interface of the Cisco IoT Control Center relates to the failure to remove scipt-related HTML tags from the website. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or gain access to confidential information through a specially crafted...

CVE-2022-36100

XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform. Starting with version 1.7 in XWiki Platform Applications Tag and prior to 13.10.6 and 14.4 in XWiki Platform Tag UI, the tags document Main.Tags in XWiki didn't sanitize user inputs...

Design/Logic Flaw

XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform. Starting with version 1.7 in XWiki Platform Applications Tag and prior to 13.10.6 and 14.4 in XWiki Platform Tag UI, the tags document Main.Tags in XWiki didn't sanitize user inputs...

CVE-2022-36100 XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection

XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform. Starting with version 1.7 in XWiki Platform Applications Tag and prior to 13.10.6 and 14.4 in XWiki Platform Tag UI, the tags document Main.Tags in XWiki didn't sanitize user inputs...

CVE-2022-36100

CVE-2022-36100 affects XWiki Platform Applications Tag and XWiki Platform Tag UI. The vulnerability stems from improper sanitization of the Main.Tags document, allowing users with view rights to execute arbitrary Groovy, Python and Velocity code with programming rights, bypassing rights checks an...

CVE-2022-36100 XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection

XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform. Starting with version 1.7 in XWiki Platform Applications Tag and prior to 13.10.6 and 14.4 in XWiki Platform Tag UI, the tags document Main.Tags in XWiki didn't sanitize user inputs...

CVE-2022-36095

CVE-2022-36095 : XWiki Platform is vulnerable to a Cross-Site Request Forgery (CSRF) for adding or removing tags on pages. Affected releases are before versions 13.10.5 and 14.3 . The issue is fixed in those versions. As a workaround, users can locally modify the template involved (documentTags.v...

HTML Injection vulnerability in create tag functionality

Vulnerability Details In the Microweber CMS, While doing a live edit on to the application, we have the option to create a new global tag in the application. While creating a global tag, the "Tag Name" input field doesn't properly get sanitized and it's vulnerable to HTML Injection vulnerability...

Regular Expression Denial Of Service (ReDoS)

Mako is vulnerable to regular expression denial of service. The vulnerability exists due to the insecure regex pattern used for the match attribute in the matchtagstart function of lexer.py, allowing an attacker to crash the application by providing a large number of tag quotes within its quoted...

PT-2022-23191 · Xwiki · Xwiki Platform Applications Tag +1

Name of the Vulnerable Software and Affected Versions: XWiki Platform Applications Tag versions 1.7 through 13.10.5 XWiki Platform Tag UI versions prior to 13.10.6 and 14.4 Description: The tags document Main.Tags in XWiki did not sanitize user inputs properly, allowing users with view rights on...

XWiki Platform 跨站请求伪造漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the French company XWiki. A cross-site request forgery vulnerability exists in XWiki Platform versions prior to 13.10.5 and prior to 14.3, which stems from the ability to perform a cross-site request...

多款 XWiki Platform 产品代码注入漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from XWiki France. A security vulnerability exists in the XWiki Platform Tag UI versions prior to 13.10.6 and 14.4, which stems from the fact that the tag document "Main.Tags" is not properly cleaned up from...

The vulnerability of the do_tag() function in the Vim text editor allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the dotag function in the Vim text editor is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Slackware Linux 15.0 / current mozilla-thunderbird Multiple Vulnerabilities (SSA:2022-249-02)

The version of mozilla-thunderbird installed on the remote host is prior to 102.2.1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-249-02 advisory. - When receiving an HTML email that contained an iframe element, which used a srcdoc attribute to define the...

Debian DSA-5223-1 : chromium - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5223 advisory. Multiple security issues were discovered in Chromium, which could result in the execution of arbitrary code, denial of service or information disclosure. For the...

Microsoft Edge (Chromium) < 105.0.1343.25 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 105.0.1343.25. It is, therefore, affected by multiple vulnerabilities as referenced in the September 1, 2022 advisory. - Use after free in Network Service. CVE-2022-3038 - Use after free in WebSQL. CVE-2022-3039,...