PT-2023-28991 · Altair · Altair

Name of the Vulnerable Software and Affected Versions: Altair versions prior to 5.2.5 Description: The Altair GraphQL Client Desktop Application does not sanitize external URLs before passing them to the underlying system and does not isolate the context of the renderer process. This issue affect...

The vulnerability of the Simple URLs plugin in the WordPress content management system allows attackers to perform cross-site scripting attacks.

The vulnerability of the Simple URLs plugin in the WordPress content management system exists due to the lack of measures taken to protect the website’s structure. Exploiting this vulnerability allows attackers to perform cross-site scripting attacks...

ROS-20230929-01

Vulnerability in the URI component of the Ruby programming language, related to improper handling of invalid URLs containing certain characters. Exploitation of the vulnerability could allow an attacker, acting remotely, to cause a denial of service Vulnerability in the...

CVE-2023-3906

An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy...

Input validation

An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy...

CVE-2023-3906

Removed by vendor...

CVE-2023-3906 Improper Validation of Specified Type of Input in GitLab

An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy...

CVE-2023-3906 Improper Validation of Specified Type of Input in GitLab

An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy...

CVE-2023-44469

A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to arbitrary URLs through the requesturi authorization parameter. This is similar to CVE-2020-10770...

Default configuration

TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity...

PT-2023-26766 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 12.3 through 16.2.7 GitLab EE versions 16.3 through 16.3.4 GitLab EE versions 16.4 through 16.4.0 Description: An input validation issue in the asset proxy allowed an authenticated attacker to craft image URLs which bypass...

Virtuozzo Hybrid Infrastructure 5.4 Update 4 Hotfix 1 (5.4.4-119)

This update provides important stability fixes for the core storage, object storage, and compute services. Vulnerability id: VSTOR-74982 Fixed the customization of S3 URLs with CNAME records. Vulnerability id: VSTOR-75137, VSTOR-75225 Fixed storage and metadata service issues related to incorrect...

CVE-2023-40667

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Lasso Simple URLs plugin = 117 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Lasso Simple URLs plugin = 117 versions...

CVE-2023-40667 WordPress Simple URLs Plugin <= 117 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Lasso Simple URLs plugin = 117 versions...

CVE-2023-40667 WordPress Simple URLs Plugin <= 117 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Lasso Simple URLs plugin = 117 versions...

CVE-2023-40667

CVE-2023-40667: Unauthenticated Reflected Cross-Site Scripting in WordPress Simple URLs plugin affecting versions

Simple URLs < 118 - Reflected XSS

Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress plugin Simple URLs - Link Cloaking, Product Displays, and Affiliate Link Management Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-27587 · Unknown · Lasso Simple Urls

Name of the Vulnerable Software and Affected Versions: Lasso Simple URLs plugin versions = 117 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to steal user da...