CVE-2023-46737 Possible endless data attack from attacker-controlled registry in cosign

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

Sql injection

Multiple improper neutralization of SQL parameters in module AfterMail aftermailpresta for PrestaShop, before version 2.2.1, allows remote attackers to perform SQL injection attacks via idcustomer, idconf, idproduct and token parameters in aftermailajax.php via the 'idproduct' parameter in hooks...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Zizou1988 IRivYou plugin = 2.2.1 versions...

Debian: Security Advisory (DLA-3615-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-42298

An issue in GPAC GPAC v.2.2.1 and before allows a local attacker to cause a denial of service via the QDecCoordOnUnitSphere function of file src/bifs/unquantize.c...

libcue buffer error vulnerability

libcue is a CUE table parser library by the individual developer Ilya Lipnitskiy. A buffer error vulnerability exists in libcue version 2.2.1 and earlier. An attacker can exploit this vulnerability to execute arbitrary code...

PT-2023-5554 · Gpac +2 · Gpac +2

Name of the Vulnerable Software and Affected Versions: GPAC versions through 2.2.1 Description: The issue is related to the incorrect use of dynamic memory in the gf bifs flush command list function of the GPAC multimedia platform. This can lead to a denial of service when exploited. The...

CVE-2023-41000

GPAC through 2.2.1 has a use-after-free vulnerability in the function gfbifsflushcommandlist in bifs/memorydecoder.c...

GPAC Resource Management Error Vulnerability

GPAC is an open source multimedia framework. A security vulnerability exists in GPAC version 2.2.1 and prior versions, which stems from a memory reuse after release issue...

PT-2023-26793 · Ntsc-Crt · Ntsc-Crt

Name of the Vulnerable Software and Affected Versions: NTSC-CRT version 2.2.1 Description: The issue is related to an integer overflow and out-of-bounds write in the loadBMP function in bmp rw.c. This occurs because the file's width, height, and BPP are not validated. The vendor notes that the ma...

Debian: Security Advisory (DLA-3507-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-7JRR-FWHW-762V Jenkins Sumologic Publisher Plugin vulnerable to cross-site request forgery

Jenkins Sumologic Publisher Plugin 2.2.1 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL. Additionally, this form validation method does not require POST requests,...

CVE-2023-37958

A cross-site request forgery CSRF vulnerability in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers to connect to an attacker-specified URL...

Jenkins Plugin Sumologic Publisher 跨站请求伪造漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

WordPress plugin Tutor LMS 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2023-2337 ConvertKit < 2.2.1 - Reflected XSS

The ConvertKit WordPress plugin before 2.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2023-19138 · Unknown · Chris Reynolds Progress Bar Plugin

Name of the Vulnerable Software and Affected Versions: Chris Reynolds Progress Bar plugin versions = 2.2.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with contributor or higher permissions. Recommendations: For Chris Reynolds Progress B...

WordPress plugin Progress Bar 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

CVE-2023-30615 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in iris-web

Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting XSS vulnerability has been identified in iris-web, affecting multiple locations . The vulnerability in allows an attacker to inject malicious...

CVE-2023-30615 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in iris-web

Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting XSS vulnerability has been identified in iris-web, affecting multiple locations . The vulnerability in allows an attacker to inject malicious...