Design/Logic Flaw

For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by...

SUSE CVE-2023-31047

In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField only the last uploaded file was validated. However,...

CVE-2020-22334

Cross Site Request Forgery CSRF vulnerability in beescms v4 allows attackers to delete the administrator account via crafted request to /admin/adminadmin.php...

Fedora: Security Advisory for openbgpd (FEDORA-2023-c804000502)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 37 Update: openbgpd-7.9-1.fc37

OpenBGPD is a free implementation of the Border Gateway Protocol BGP, Version 4. It allows ordinary machines to be used as routers exchanging routes with other systems speaking the BGP protocol...

[SECURITY] Fedora 38 Update: openbgpd-7.9-1.fc38

OpenBGPD is a free implementation of the Border Gateway Protocol BGP, Version 4. It allows ordinary machines to be used as routers exchanging routes with other systems speaking the BGP protocol...

CKEditor 4.x < 4.21 XSS Vulnerability - Windows

CKEditor 4 is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Debian: Security Advisory (DLA-481-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 37 Update: php-symfony4-4.4.50-1.fc37

Symfony PHP framework version 4. NOTE: Does not require PHPUnit bridge...

CVE-2022-43271

Inhabit Systems Pty Ltd Move CRM version 4, build 260 was discovered to contain a cross-site scripting XSS vulnerability via the User profile component...

Cross site scripting

Inhabit Systems Pty Ltd Move CRM version 4, build 260 was discovered to contain a cross-site scripting XSS vulnerability via the User profile component...

Inhabit Systems Move CRM 跨站脚本漏洞

Inhabit Systems Move CRM is a comprehensive business management system and CRM from Inhabit Systems Australia. A security vulnerability exists in Inhabit Systems Move CRM version 4 build 260, which stems from its User profile component that allows an attacker to implement cross-site scripting...

CVE-2022-43271

CVE-2022-43271 affects Inhabit Systems Move CRM version 4, build 260, with a cross-site scripting (XSS) vulnerability via the User profile component. Public details in the provided documents confirm the issue exists and indicate a CVSS v3.1 base score of 5.4 (MEDIUM) with network attack vector, l...

Moodle 3.11.x < 3.11.11, 4.x < 4.0.5 XSS Vulnerability (MSA-22-0031)

Moodle is prone to a cross-site scripting XSS vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

CVE-2022-43782

Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API under the usermanagement path. This vulnerability can only be exploited by IPs specified under the...

strongSwan 4.x < 5.9.8 DoS Vulnerability

strongSwan is prone to a denial of service DoS vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

Design/Logic Flaw

A security vulnerability was discovered in the Eaton Foreseer EPMS software. Foreseer EPMS connects an operation’s vast array of devices to assist in the reduction of energy consumption and avoid unplanned downtime caused by the failures of critical systems. A threat actor may upload arbitrary...

Crowd DC Critical Security Misconfiguration Vulnerability - CVE-2022-43782

Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and call privileged endpoints in Crowd's REST API under the usermanagement path. This vulnerability can only be exploited by IPs specified under the crowd application...

CVE-2018-25047

In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smartyfunctionmailto, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user...

PT-2022-22601 · Baijiacms · Baijiacms

Name of the Vulnerable Software and Affected Versions: Baijicms version 4 Description: The issue is related to an arbitrary file upload vulnerability. Recommendations: For Baijicms version 4, consider restricting access to file upload functionality until a patch is available...