3346 matches found
CVE-2022-0687
The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role...
Spoofing
The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role...
CVE-2022-25766
The package ungit before 1.5.20 are vulnerable to Remote Code Execution RCE via argument injection. The issue occurs when calling the /api/fetch endpoint. User controlled values remote and ref are passed to the git fetch command. By injecting some git options it was possible to get arbitrary...
CVE-2022-26101
Fiori launchpad - versions 754, 755, 756, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...
Rust's regex crate vulnerable to regular expression denial of service
This is a cross-post of the official security advisoryadvisory. The official advisory contains a signed version with our PGP key, as well. advisory: https://groups.google.com/g/rustlang-security-announcements/c/NcNNL1Jq7Yw The Rust Security Response WG was notified that the regex crate did not...
CVE-2022-24713
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those tunable mitigations already provide sane defaults to preven...
Authorization Bypass
url-parse is vulnerable to authorization bypass. The vulnerability exists because the protocol of the URL returned by the parser is not validated correctly, allowing an attacker to bypass URLs via \b characters and the user-controlled key...
CVE-2022-0691
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9...
CVE-2022-0691
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9...
DEBIAN-CVE-2022-0691
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9...
CVE-2022-0691
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9...
Authorization
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9...
UBUNTU-CVE-2022-0691
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9...
Authorization Bypass
url-parse is vulnerable to authorization bypass. Because the library does not properly validate the hostname in the toString function of index.js, an attacker can redirect to malicious URLs using the user-controlled key when no port number is specified in the URL...
GHSA-HGJH-723H-MX2J Authorization Bypass Through User-Controlled Key in url-parse
url-parse prior to version 1.5.8 is vulnerable to Authorization Bypass Through User-Controlled Key...
Authorization Bypass Through User-Controlled Key in url-parse
url-parse prior to version 1.5.8 is vulnerable to Authorization Bypass Through User-Controlled Key...
CVE-2022-0691 Authorization Bypass Through User-Controlled Key in unshiftio/url-parse
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9...
CVE-2022-0691
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9...