326 matches found
CVE-2023-1575
The Mega Main Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
PYSEC-2023-28
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2...
PYSEC-2023-28
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2...
Mlflow 安全漏洞
Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow versions prior to 2.2.2 that stems from the presence of an absolute path traversal vulnerability...
WordPress plugin InPost Gallery 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
WordPress plugin Woo Bulk Price Update 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
SUSE CVE-2017-10869
Buffer overflow in H2O version 2.2.2 and earlier allows remote attackers to cause a denial-of-service in the server via unspecified vectors...
SUSE CVE-2023-23943
Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network of the Nextcloud Server. It is recommended that the Nextcloud Maill app is...
SUSE CVE-2023-23944
Nextcloud mail is an email app for the nextcloud home server platform. In versions prior to 2.2.2 user's passwords were stored in cleartext in the database during the duration of OAuth2 setup procedure. Any attacker or malicious user with access to the database would have access to these user...
PT-2023-6985 · WordPress · Woo Bulk Price Update
Name of the Vulnerable Software and Affected Versions: Woo Bulk Price Update WordPress plugin versions prior to 2.2.2 Description: The issue is related to a reflected cross-site scripting vulnerability. It is triggered by the page parameter to the techno get products action and can only be...
dompurify vulnerable to Cross-site Scripting
dompurify prior to version 2.2.2 is vulnerable to cross-site scripting when converting from SVG namespace...
GHSA-XV6X-456V-24XH gotify/server vulnerable to Cross-site Scripting in the application image file upload
Impact The XSS vulnerability allows authenticated users to upload .html files. With that, an attacker could execute client side scripts if another user opened a link, such as: https://push.example.org/image/alphanumeric string.html An attacker could potentially take over the account of the user...
CVE-2022-46181
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulnerability that allows authenticated users to upload .html files. An attacker could execute client side scripts if another user opened a link. The attacker cou...
Spoofing
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulnerability that allows authenticated users to upload .html files. An attacker could execute client side scripts if another user opened a link. The attacker cou...
CVE-2022-46181 Gotify server XSS vulnerability in the application image file upload
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulnerability that allows authenticated users to upload .html files. An attacker could execute client side scripts if another user opened a link. The attacker cou...
CVE-2022-46181 Gotify server XSS vulnerability in the application image file upload
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulnerability that allows authenticated users to upload .html files. An attacker could execute client side scripts if another user opened a link. The attacker cou...
CVE-2022-46181
The CVE-2022-46181 entry describes an XSS vulnerability in Gotify server prior to version 2.2.2. Authenticated users could upload .html files via the image upload functionality, enabling client‑side script execution if another user clicked a crafted link (e.g., an image path with an HTML file). T...
PT-2022-27792 · Unknown · Gotify Server
Name of the Vulnerable Software and Affected Versions: Gotify server versions prior to 2.2.2 Description: The Gotify server contains an issue that allows authenticated users to upload .html files, which can lead to the execution of client-side scripts if another user opens a link. This could...
PT-2022-6377 · Nextcloud · Nextcloud Mail
Name of the Vulnerable Software and Affected Versions: Nextcloud mail versions prior to 1.15.0 Nextcloud mail versions prior to 2.2.2 Description: The issue is related to insufficient validation of incoming requests in the Nextcloud mail client, allowing a remote attacker to scan internal service...