mruby 缓冲区错误漏洞

mruby is a lightweight implementation of the Ruby language. A security vulnerability exists in versions prior to mruby 3.1.0-rc, which stems from an untrusted pointer destructor in the function mrbvmexec, which can be exploited by an attacker to cause a segmentation error and application crash...

CVE-2023-0379

The Spotlight Social Feeds WordPress plugin before 1.4.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0362

Themify Portfolio Post WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0260 WP Review Slider < 12.2 - Subscriber+ SQLi

The WP Review Slider WordPress plugin before 12.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber...

GPAC 缓冲区错误漏洞

GPAC is an open source multimedia framework. A security vulnerability exists in versions prior to GPAC v2.3.0-DEV that stems from a heap-based buffer overflow...

PT-2023-18444

Name of the Vulnerable Software and Affected Versions Screen Creator Advance 2 versions 0.1.1.4 Build01 and earlier Description An out-of-bound write issue exists due to a lack of error handling when out of specification errors are detected. This could lead to information disclosure and/or...

CVE-2022-45090

Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection. This issue affects Smartpower Web: before 23.01.01...

CVE-2022-45085

Server-Side Request Forgery SSRF vulnerability in Group Arge Energy and Control Systems Smartpower Web allows : Server Side Request Forgery. This issue affects Smartpower Web: before 23.01.01...

CVE-2023-21432

Improper access control vulnerabilities in Smart Things prior to 1.7.93 allows to attacker to invite others without authorization of the owner...

CVE-2023-0740 Cross-site Scripting (XSS) - Stored in answerdev/answer

Cross-site Scripting XSS - Stored in GitHub repository answerdev/answer prior to 1.0.4...

formula 安全漏洞

formula is a math and string arithmetic library open-sourced by hapi.js. A security vulnerability exists in formula versions prior to 3.0.1, which stems from the fact that carefully crafted string input to the formula parser may result in polynomial execution time and denial of service...

CVE-2023-0741 Cross-site Scripting (XSS) - DOM in answerdev/answer

Cross-site Scripting XSS - DOM in GitHub repository answerdev/answer prior to 1.0.4...

DEBIAN-CVE-2023-0702

Type confusion in Data Transfer in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

Google Chrome 缓冲区错误漏洞

Google Chrome is a web browser from Google, an American company. An out-of-bounds read vulnerability exists in versions of Google Chrome prior to 110.0.5481.77. The vulnerability stems from the lack of proper validation of user-supplied data in WebRTC, where specially crafted data may trigger a...

CVE-2023-0234

The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue...

CVE-2022-4664 Logo Slider < 3.6.0 - Contributor+ Stored XSS in Shortcode

The Logo Slider WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0178 Annual Archive < 1.6.0 - Contributor+ Stored XSS

The Annual Archive WordPress plugin before 1.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress plugin HUSKY 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

Froxlor 代码注入漏洞

Froxlor is a lightweight server management software from the Froxlor team. A code injection vulnerability exists in Froxlor versions prior to 2.0.10, which can be exploited by an attacker to gain root privileges...

PrestaShop SQL注入漏洞

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, short message alerts, and product image scaling. A security vulnerability exists in PrestaShop Administrative Mandate versions prior to v1.7.1, which stems...