@webiny/react-rich-text-renderer vulnerable to insecure rendering of rich text content

Overview @webiny/react-rich-text-renderer is a react component to render data coming from Webiny Headless CMS and Webiny Form Builder. The @webiny/react-rich-text-renderer package depends on the editor.js rich text editor to handle rich text content. The CMS stores rich text content from the...

QNAP Systems QTS 和 QuTS hero 安全漏洞

QNAP Systems QTS and QNAP Systems QuTS hero are both products of China-based QNAP Systems.QNAP Systems QTS is an operating system for use with entry- to mid-level QNAP NAS.QNAP Systems QuTS hero is an operating system. A security vulnerability exists in QNAP QTS and QuTS hero, which stems from an...

CVE-2023-4065

A flaw was found in Red Hat AMQ Broker Operator, where it displayed a password defined in ActiveMQArtemisAddress CR, shown in plain text in the Operator Log. This flaw allows an authenticated local attacker to access information outside of their permissions...

Red Hat AMQ Broker 安全漏洞

Red Hat AMQ Broker is a pure Java multi-protocol message broker from Red Hat. It is built on an efficient asynchronous core with fast native logging for message persistence and unshared state replication options for high availability. A security vulnerability exists in Red Hat AMQ Broker, which...

PYSEC-2023-150

Buffer Overflow vulnerability in tEXtToDataBuf function in pngimage.cpp in Exiv2 0.27.1 allows remote attackers to cause a denial of service and other unspecified impacts via use of crafted file...

Artifex Software MuPDF 资源管理错误漏洞

Artifex Software MuPDF is a free and lightweight PDF reader from Artifex Software, USA. A security vulnerability exists in Artifex Software MuPDF version 1.16.0, which originates from a post-release reuse vulnerability in the svgdevtextspanaspathsdefs function in source/fitz/svg-device.c. The...

PT-2023-11607 · Artifex +1 · Mupdf +1

Name of the Vulnerable Software and Affected Versions: Artifex Software MuPDF version 1.16.0 Description: A Use After Free vulnerability in the svg dev text span as paths defs function in source/fitz/svg-device.c allows remote attackers to cause a denial of service via the opening of a crafted PD...

ncurses 缓冲区错误漏洞

ncurses is a character terminal processing library that provides a set of functions that can be called by the user to generate a text-based user interface. A security vulnerability exists in ncurses version 6.1 due to a buffer overflow in the fmtentry method of progs/dumpentry.c. The vulnerabilit...

ncurses 缓冲区错误漏洞

ncurses is a character terminal processing library that provides a set of functions that can be called by the user to generate a text-based user interface. A security vulnerability exists in ncurses version 6.1 due to a buffer overflow in the oneonemapping method of progs/dumpentry.c. The...

ncurses 缓冲区错误漏洞

ncurses is a character terminal processing library that provides a set of functions that can be called by the user to generate a text-based user interface. A security vulnerability exists in ncurses version 6.1 due to a buffer overflow in the fmtentry method of progs/dumpentry.c. The vulnerabilit...

How to add custom text or a disclaimer to a login schema

How to add a custom text / Disclaimer to the XML file of a login schema...

Password Plaintext Storage

The application stored a password in a database in plaintext format. Storing user passwords in a database in plaintext is a security vulnerability that can have serious consequences. If an attacker is able to gain access to the database, they will be able to see all of the user passwords in plain...

Vim Divide by Zero Flaw Vulnerability

Vim is a cross-platform text editor. Vim suffers from a divide-by-zero flaw vulnerability that originates from a divide-by-zero flaw in the function scrollcursorbot. An attacker can exploit this vulnerability to cause a denial of service attack...

CVE-2023-39961 Text does not respect "Allow download" permissions

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 24.0.4 and prior to versions 25.0.9, 26.0.4, and 27.0.1, when a folder with images or an image was shared without download permissions, the user could add the image inline into a text file and...

CVE-2023-36314

There is a Cross Site Scripting XSS vulnerability in the value-text-osmsemailrequestmessage parameters of index.php in PHPJabbers Callback Widget v1.0...

CVE-2023-36314

There is a Cross Site Scripting XSS vulnerability in the value-text-osmsemailrequestmessage parameters of index.php in PHPJabbers Callback Widget v1.0...

Nextcloud Access Control Error Vulnerability

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. An access control error vulnerability exists in Nextcloud Server. An attacker could exploit the vulnerability to inline add an image to a text file and...

GHSA-RG2C-CFXV-QP6F Denial of service in jackson-dataformat-toml

Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

Denial of service in jackson-dataformat-toml

Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

CVE-2023-3894

Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...