1963 matches found
SUSE CVE-2022-40284
A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code execution. A local attacker can exploit this if the ntfs-3g binary is setuid root. A physically proximate attacker can exploit this if NTFS-3G software is configured to execute upon...
OESA-2023-1077 lxc security update
Containers are insulated areas inside a system, which have their own namespace for filesystem, network, PID, IPC, CPU and memory allocation and which can be created using the Control Group and Namespace features included in the Linux kernel. Security Fixes: lxc-user-nic in lxc through 5.0.1 is...
CVE-2023-0236
The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the resetkey and userid parameters before outputting then back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Gimmie vBulletin SQL注入漏洞
Gimmie vBulletin is a Gimmie open source forum plugin . Gimmie vBulletin version 1.2.2 suffers from a SQL injection vulnerability , the vulnerability stems from the wrong operation of the parameter userid can lead to sql injection...
WordPress plugin Tutor LMS 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
Checkmk 输入验证错误漏洞
Checkmk is an editor. Checkmk has a security vulnerability that stems from its incorrect input validation of LDAP user ids allowing an attacker who has control over the LDAP user id to manipulate files on the server. The following versions are affected: 2.1.0p19 and earlier, 2.0.0p32 and earlier,...
CVE-2023-24058
Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservationsave.php. NOTE: 2.5.5 is a version from 2014; the latest version of Booked Scheduler is not affected. However, LabArchives Scheduler Sep 6, 2022 Feature...
CVE-2023-24039
A stack-based buffer overflow in ParseColors in libXm in Common Desktop Environment 1.6 can be exploited by local low-privileged users via the dtprintinfo setuid binary to escalate their privileges to root on Solaris 10 systems. NOTE: This vulnerability only affects products that are no longer...
UBUNTU-CVE-2022-3870
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. GitLab allows unauthenticated users to download user avatars using the victim's user ID, on private...
PT-2023-13635 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 10.0 through 15.5.7 GitLab CE/EE versions 15.6 through 15.6.4 GitLab CE/EE versions 15.7 through 15.7.2 Description: An issue has been discovered in GitLab CE/EE that allows unauthenticated users to download user avatars...
CVE-2022-47859
Lead Management System v1.0 is vulnerable to SQL Injection via the userid parameter in changePassword.php...
Lead Management System SQL注入漏洞
Lead management system is a lead management system developed by Mayuri K. The Lead Management System v1.0 version is vulnerable to SQL injection, which stems from the lack of validation of external input SQL statements in the userid parameter of changePassword.php. An attacker could use this...
CVE-2023-0111
creationtimestamp| type| source ---|---|--- 2023-01-07 07:25:37+00:00| seen| https://t.me/cibsecurity/56106 2025-04-09 15:47:49+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/11100...
CVE-2022-3911
creationtimestamp| type| source ---|---|--- 2023-01-03 00:29:44+00:00| seen| https://t.me/cibsecurity/55770 2025-04-10 18:49:36+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/11317...
Admin is able to ARCHIVE OWN Account leads to Deactivate ADMIN Account
Description As fer the Flow Admin can't ARCHIVE OWN account . i was able to ARCHIVE ADMIN OWN Account by intercept the request and change ID Value to Admin. which leads to ARCHIVED the ADMIN Account , :/ Please Restored it Might Be possible to DELETE Admin Account too , after ARCHIVE Account it's...
CVE-2022-4156
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the userid POST parameter before concatenating it to an SQL query in ajax-functions-backend.php. This may allow malicious users with at least author privilege to leak sensitive...
PT-2022-25930 · WordPress · Contest Gallery Pro +1
Name of the Vulnerable Software and Affected Versions: Contest Gallery WordPress plugin versions prior to 19.1.5.1 Contest Gallery Pro WordPress plugin versions prior to 19.1.5.1 Description: The issue arises from the failure to escape the wp user id GET parameter before it is concatenated to an...
PT-2022-25938 · WordPress · Contest Gallery Pro +1
Name of the Vulnerable Software and Affected Versions: Contest Gallery WordPress plugin versions prior to 19.1.5.1 Contest Gallery Pro WordPress plugin versions prior to 19.1.5.1 Description: The issue arises from the failure to escape the user id POST parameter before it is concatenated to an SQ...
WordPress Plugin Contest Gallery SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...