13392 matches found
PT-2022-13586
Name of the Vulnerable Software and Affected Versions WP Statistics WordPress plugin versions prior to 13.2.2 Description The issue arises from the WP Statistics WordPress plugin not sanitizing the REQUEST URI parameter before outputting it back in the rendered page. This leads to Cross-Site...
RHEL 7 : rh-nodejs12-nodejs (RHSA-2022:4914)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4914 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...
CVE-2022-32271
In Real Player 20.0.8.310, there is a DCP:// URI Remote Arbitrary Code Execution Vulnerability. This is an internal URL Protocol used by Real Player to reference a file that contains an URL. It is possible to inject script code to arbitrary domains. It is also possible to reference arbitrary loca...
CVE-2022-32271
CVE-2022-32271 relates to RealNetworks Real Player 20.0.8.310, where a DCP:// URI (an internal protocol used to reference a file containing a URL) can be abused to inject script code to arbitrary domains and reference arbitrary local files, enabling remote arbitrary code execution. The CVSS estim...
CVE-2022-32271
In Real Player 20.0.8.310, there is a DCP:// URI Remote Arbitrary Code Execution Vulnerability. This is an internal URL Protocol used by Real Player to reference a file that contains an URL. It is possible to inject script code to arbitrary domains. It is also possible to reference arbitrary loca...
CVE-2022-32271: Improper Neutralization of Input During Web Page Generation
In Real Player 20.0.8.310, there is a DCP:// URI Remote Arbitrary Code Execution Vulnerability. This is an internal URL Protocol used by Real Player to reference a file that contains an URL. It is possible to inject script code to arbitrary domains. It is also possible to reference arbitrary loca...
PT-2022-21196
Name of the Vulnerable Software and Affected Versions Real Player version 20.0.8.310 Description The issue concerns an internal URL protocol used by Real Player to reference files containing URLs, allowing for the injection of script code into arbitrary domains and the referencing of arbitrary...
Fixed CVEs in java-1.8.0-openjdk: CVE-2022-21434, CVE-2022-21443, CVE-2022-21476, CVE-2022-21426, CVE-2022-21496
Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u332-b09. That fixes following CVEs: - CVE-2022-21476: Defective secure validation in Apache Santuario - CVE-2022-21496: URI parsing inconsistencies - CVE-2022-21434: Improper object-to-string conversion in AnnotationInvocationHandler -...
Exploit for CVE-2022-30190
POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina...
Watch Out! Researchers Spot New Microsoft Office Zero-Day Exploit in the Wild
Cybersecurity researchers are calling attention to a zero-day flaw in Microsoft Office that could be abused to achieve arbitrary code execution on affected Windows systems. The vulnerability came to light after an independent cybersecurity research team known as naosec uncovered a Word document...
GHSA-JH7Q-5MWF-QVHW Keycloak vulnerable to Server-Side Request Forgery
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter requesturi. This flaw allows an attacker to use this parameter to execute a Server-side request forgery SSRF attack...
GHSA-7RW5-6PR4-FGH3 NukeViet Cross-Site Request Forgery (CSRF)
clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI...
GHSA-G8J7-W673-4MJP Subrion CMS CSRF Vulnerability
Subrion CMS 4.1.5 and possibly earlier versions allow CSRF to change the administrator password via the panel/members/edit/1 URI...
Subrion CMS CSRF Vulnerability
Subrion CMS 4.1.5 and possibly earlier versions allow CSRF to change the administrator password via the panel/members/edit/1 URI...
GHSA-9P7Q-V9GP-FRQ4 Dolibarr Cross-site Scripting vulnerability
An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the admin/mails.php?action=edit URI via the "Sender email for automatic emails default value in php.ini: Undefined" field...
[SECURITY] Fedora 34 Update: libxml2-2.9.14-1.fc34
This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...
Oracle Linux 8 : httpd:2.4 (ELSA-2022-1915)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1915 advisory. - Resolves: 2035030 - CVE-2021-44224 httpd:2.4/httpd: possible NULL dereference or SSRF in forward proxy configurations Tenable has extracted the...
Important: Red Hat Security Advisory: java-17-openjdk security update
An update for java-17-openjdk is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...
OpenJDK: URI parsing inconsistencies (JNDI, 8278972)
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JNDI. Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable...
OpenJDK: URI parsing inconsistencies (JNDI, 8278972)
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JNDI. Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable...