CVE-2022-47073

CVE-2022-47073 describes a cross-site scripting (XSS) vulnerability in Small CRM v3.0, specifically on the Create Ticket page where a crafted payload injected into the Subject parameter can execute arbitrary web scripts/HTML. The issue arises from improper handling of the Subject input, enabling ...

GSD-2023-1001541 mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING

mmc: vub300: fix warning - do not call blocking ops when !TASKRUNNING This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.337 by commit...

GSD-2023-1001491 platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()

platform/x86: mxm-wmi: fix memleak in mxmwmicallmxds|mx This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

GSD-2023-1001184 wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()

wifi: ath9k: hifusb: Fix use-after-free in ath9khifusbregincb This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit...

GSD-2023-1001134 mmc: vub300: fix return value check of mmc_add_host()

mmc: vub300: fix return value check of mmcaddhost This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit...

GSD-2022-1008298 ASoC: core: Fix use-after-free in snd_soc_exit()

ASoC: core: Fix use-after-free in sndsocexit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.300 by commit...

GSD-2022-1008236 ASoC: core: Fix use-after-free in snd_soc_exit()

ASoC: core: Fix use-after-free in sndsocexit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.267 by commit...

GSD-2022-1007650 firmware: google: Test spinlock on panic path to avoid lockups

firmware: google: Test spinlock on panic path to avoid lockups This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.331 by commit...

GSD-2022-1007402 firmware: google: Test spinlock on panic path to avoid lockups

firmware: google: Test spinlock on panic path to avoid lockups This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.220 by commit...

GSD-2022-1007060 firmware: google: Test spinlock on panic path to avoid lockups

firmware: google: Test spinlock on panic path to avoid lockups This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.75 by commit...

Security Bulletin: IBM SPSS SamplePower olch2x32 ActiveX control vulnerability (CVE-2013-0593)

Abstract There is a security vulnerability with the olch2x32 ActiveX control shipped by IBM SPSS SamplePower Version 3. The vulnerability allows remote attackers to execute arbitrary code on installations of SamplePower when the control is invoked as ActiveX by Microsoft Internet Explorer. Conten...

FiberHome VDSL2 Modem HG150-Ub 安全漏洞

The FiberHome VDSL2 Modem HG150-Ub is a piece of router equipment from FiberHome. A security vulnerability exists in the FiberHome VDSL2 Modem HG150-UbV3.0 version, which stems from the fact that an administrator's credentials can be submitted in a URL and can be logged, sniffed, and sniffed...

Design/Logic Flaw

laminas-diactoros is a PHP package containing implementations of the PSR-7 HTTP message interfaces and PSR-17 HTTP message factory interfaces. Applications that use Diactoros, and are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol,...

CVE-2022-35919 Authenticated requests for server update admin API allows path traversal in minio

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for admin:ServerUpdate can selectively trigger an error that in response, returns the content of the path requested. Any normal OS system would allow...

CVE-2022-35919 Authenticated requests for server update admin API allows path traversal in minio

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for admin:ServerUpdate can selectively trigger an error that in response, returns the content of the path requested. Any normal OS system would allow...

CVE-2022-35569

Blogifier v3.0 was discovered to contain an arbitrary file upload vulnerability at /api/storage/upload/PostImage. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted file...

Design/Logic Flaw

Blogifier v3.0 was discovered to contain an arbitrary file upload vulnerability at /api/storage/upload/PostImage. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted file...

CVE-2022-35569

Blogifier v3.0 was discovered to contain an arbitrary file upload vulnerability at /api/storage/upload/PostImage. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted file...

CVE-2022-35569

Blogifier v3.0 was discovered to contain an arbitrary file upload vulnerability at /api/storage/upload/PostImage. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted file...

CVE-2022-35569

Blogifier v3.0 contains an arbitrary file upload vulnerability at /api/storage/upload/PostImage that can allow attackers to execute arbitrary web scripts or HTML via a crafted file. The issue is documented across multiple sources (e.g., NVD and Red Hat CVE pages) with the root cause being an unse...