WordPress plugin SupportCandy SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

OURPHP SQL注入漏洞

OURPHP is OURPHP open source an open source, cross-platform, enterprise-level + e-commerce + applet + APP multi-terminal synchronization CMS station-building system. OURPHP version 7.2.0 and previous versions exist SQL injection vulnerability. The vulnerability stems from the application's lack o...

The vulnerability of embedded software developed by Qualcomm, related to copying from buffers without checking the size of the input data, allows a violator to execute arbitrary code.

The vulnerability of microprogramming software in embedded Qualcomm chips lies in the copying of input data from the buffer without checking its size. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

markdown-pdf 跨站脚本漏洞

npm markdown-pdf is the United States npm a Markdown file will be converted to PDF node module. A security vulnerability exists in markdown-pdf version 11.0.0, which stems from an application that does not validate user-entered Markdown content, resulting in an attacker being able to obtain local...

D-Link DIR-1935 操作系统命令注入漏洞

The D-Link DIR-1935 is a wireless router from China-based AUO D-Link. The D-Link DIR-1935 suffers from an operating system command injection vulnerability that originates when parsing an IPAddress element, where the process does not properly validate before executing a system call with a...

D-Link DIR-1935 格式化字符串错误漏洞

The D-Link DIR-1935 is a wireless router from China-based AUO D-Link. The D-Link DIR-1935 suffers from a Format String Error vulnerability that arises from failure to properly validate a user-supplied string before using it as a format descriptor...

D-Link DIR-1935 操作系统命令注入漏洞

The D-Link DIR-1935 is a wireless router from China-based AUO D-Link. The D-Link DIR-1935 suffers from an operating system command injection vulnerability that originates when parsing sub-elements within a QoSInfo element, where the process does not properly validate before executing a system cal...

D-Link DIR-1935 操作系统命令注入漏洞

The D-Link DIR-1935 is a wireless router from China-based AUO D-Link. The D-Link DIR-1935 suffers from an operating system command injection vulnerability that stems from a process not properly validating before executing a system call with a user-supplied string when parsing sub-elements within ...

IBM Aspera SQL注入漏洞

IBM Aspera is a set of fast file transfer and streaming solutions built on the IBM FASP protocol from International Business Machines IBM Inc. An SQL injection vulnerability exists in IBM Aspera Faspex version 4.4.2. The vulnerability stems from the application's lack of validation of external...

The vulnerability of the ares_set_sortlist function in the c-ares asynchronous DNS request library allows a attacker to cause service failures or have limited impact on confidentiality and integrity.

The vulnerability of the aressetsortlist function in the asynchronous DNS query library c-ares is related to the lack of validation for the input string. This allows for a possible overflow of the stack of any length. Exploiting this vulnerability could enable an attacker to cause service failure...

PT-2023-21566 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: Pimcore versions prior to 10.5.19 Description: Pimcore is an open source data and experience management platform. There is a theoretical possibility to inject custom SQL if the developer is using certain methods with input data and not doing...

WordPress plugin WordPress Infinite Scroll 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

crossplane 资源管理错误漏洞

crossplane is a framework for building cloud-native control planes without writing code. A resource management error vulnerability exists in crossplane-runtime that stems from user-supplied input that is not properly validated, which could use too much memory and lead to out of memory...

U.S. Dept Of Defense: XSS Reflected

A reflected XSS vulnerability was discovered in the web asset, allowing an attacker to inject and execute malicious code in a victim's browser...

K17245: Linux kernel vulnerability CVE-2014-9584

Security Advisory Description The parserockridgeinodeinternal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the Extensions Reference ER System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted...

CVE-2022-4750

The WP Responsive Testimonials Slider And Widget WordPress plugin through 1.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored...

WordPress plugin Loan Comparison 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress plugin Shortcode for Font Awesome 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

SUSE CVE-2018-14055

ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate his privilege and inject rogue values into znc.conf...

SUSE CVE-2018-19115

keepalived before 2.0.7 has a heap-based buffer overflow when parsing HTTP status codes resulting in DoS or possibly unspecified other impact, because extractstatuscode in lib/html.c has no validation of the status code and instead writes an unlimited amount of data to the heap...