4667 matches found
CVE-2023-2458
Use after free in ChromeOS Camera in Google Chrome on ChromeOS prior to 113.0.5672.114 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via UI interaction. Chromium security severity: High...
CVE-2023-29820
An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to access sensitive information via the EXE installer. NOTE: the vendor's perspective is that this is not a separate vulnerability relative to CVE-2023-29818 and CVE-2023-29819...
Rocket.Chat 授权问题漏洞
Rocket.Chat is an open source team chat software. A security vulnerability exists in versions prior to Rocket.Chat 6.0 that stems from improper authorization and allows an attacker to manipulate the parameter rid to change certain methods...
Vyper 缓冲区错误漏洞
Vyper is the Pythonic smart contract language for EVM. A buffer error vulnerability exists in Vyper versions prior to 0.3.8. An attacker exploited the vulnerability to cause an array access out-of-bounds...
WordPress plugin Themify Portfolio Post 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...
Western Digital My Cloud 命令注入漏洞
Western Digital My Cloud is a personal cloud storage device from Western Digital. A security vulnerability exists in Western Digital My Cloud OS 5 prior to version 5.26.119, which stems from a command injection vulnerability that could allow an attacker to execute code against vulnerable CGI file...
CVE-2023-2114
The NEX-Forms WordPress plugin before 8.4 does not properly escape the table parameter, which is populated with user input, before concatenating it to an SQL query...
CVE-2023-1649 ChatBot < 4.5.1 - Admin+ Stored XSS
The AI ChatBot WordPress plugin before 4.5.1 does not sanitise and escape numerous of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
TeamPass 跨站脚本漏洞
TeamPass is an open source password manager from the individual developer Nils Laumaillé. A cross-site scripting vulnerability exists in versions prior to TeamPass 3.0.7, which can be exploited by an attacker to inject malicious code into a shared folder, steal user credentials, and compromise th...
DEBIAN-CVE-2023-2465
Inappropriate implementation in CORS in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...
PortlandLabs Concrete CMS 跨站脚本漏洞
PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. in the United States. A cross-site scripting vulnerability exists in PortlandLabs Concrete CMS versions prior to 9.2. An attacker can exploit this vulnerability to perform cross-site scripti...
Pimcore 跨站脚本漏洞
Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce frameworks and product information management applications. A cross-site scripting vulnerability exists in...
Acronis Agent 安全漏洞
Acronis Agent is an agent software from Acronis Singapore. A security vulnerability exists in Acronis Agent versions prior to 30161 that originates from an unauthenticated API endpoint and can be exploited by an attacker to cause a denial of service...
CVE-2022-40725
PingID Desktop prior to the latest released version 1.7.4 contains a vulnerability that can be exploited to bypass the maximum PIN attempts permitted before the time-based lockout is activated...
ALPINE-CVE-2023-29469
An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to...
CVE-2023-0276 Weaver Xtreme Theme Support < 6.2.7 - Contributor+ Stored XSS
The Weaver Xtreme Theme Support WordPress plugin before 6.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...
Clusternet 安全漏洞
Clusternet is an open source Kubernetes multi-cluster management tool from Clusternet that helps users manage and coordinate workloads across multiple Kubernetes clusters. A security vulnerability exists in Clusternet versions prior to 0.15.2, which stems from a vulnerability that allows an...
DEBIAN-CVE-2023-30798
There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service...
Ribose RNP 安全漏洞
Ribose RNP is an application from Ribose, Inc. A security vulnerability exists in Ribose RNP versions prior to 0.15.1 that stems from the lack of implementation of a required step in the cryptographic algorithm, resulting in faulty encryption and leaving the key in the plaintext state...