GHSA-RF66-HMQF-Q3FC Improper Neutralization of Input During Web Page Generation in Select2

In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data...

Improper Neutralization of Input During Web Page Generation in Select2

In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data...

GHSA-W8GX-HHCX-PX6W Openstack tripleo-heat-templates unauthenticated file access

A resource-permission flaw was found in the tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thu...

Openstack tripleo-heat-templates unauthenticated file access

A resource-permission flaw was found in the tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thu...

Plone Unauthorized Access Vulnerability

Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5...

GHSA-QC57-H2F7-P4HX Plone Unauthorized Access Vulnerability

Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5...

Dolibarr SQL Injection vulnerability

SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categorieslist.php, /accountancy/admin/journalslist.php, /admin/dict.php,...

lorax-templates-rhel bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

lorax-templates-Rocky Linux bug fix and enhancement update

An update is available for lorax-templates-rhel. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Roc...

nuclei-templates

This repository is an offensive tool for nuclei templates. It is a community-driven collection of templates for the nuclei engine to find security vulnerabilities in applications. The repository contains various templates, including CVEs, and is maintained by the projectdiscovery team. The...

Auth0 跨站脚本漏洞

Auth0 is is an authentication agent that supports social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. A security vulnerability exists in auth0-lock version 11.32.2 and prior versions, which stems from an invalid HTML code that can be injected...

CVE-2022-23723

An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow...

CVE-2022-23723

An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow...

CVE-2022-23723

An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow...

Security feature bypass

An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow...

CVE-2022-23723

The CVE-2022-23723 entry concerns PingFederate PingOne MFA Integration Kit. A vulnerability exists where MFA can be bypassed when adapter HTML templates are used within an authentication flow. Affected: PingFederate PingOne MFA Integration Kit (HTML adapters in the login flow). Root cause: bypass...

PT-2022-11526 · Suse · Suse Rancher

Name of the Vulnerable Software and Affected Versions: SUSE Rancher versions prior to 2.5.13 SUSE Rancher versions prior to 2.6.4 Description: A vulnerability in SUSE Rancher allows write access to the Catalog for any user when the restricted-admin role is enabled. This issue affects customers...

PT-2022-16228 · Ping Identity · Pingfederate Pingone Mfa Integration Kit

Name of the Vulnerable Software and Affected Versions: PingFederate PingOne MFA Integration Kit affected versions not specified Description: An MFA bypass issue exists when adapter HTML templates are used as part of an authentication flow. This allows for potential bypass of multi-factor...

CVE-2022-28508

creationtimestamp| type| source ---|---|--- 2022-04-30 03:26:47+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/2067 2022-04-30 17:55:24+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/5909 2025-04-24 13:45:33+00:00| confirmed|...

WBCE CMS Cross-Site Scripting Vulnerability

WBCE CMS is a WBCB CMS forum that converts HTML to WBCB CMS templates.A cross-site scripting vulnerability exists in WBCE CMS version 1.5.2, which can be exploited by attackers to execute malicious code, tamper with pages to perform phishing attacks, and trick users into logging in again and then...