4750 matches found
showdoc 跨站脚本漏洞
showdoc is an open source tool ideal for IT teams to share documents online. showdoc versions prior to v2.10.4 contain a file upload vulnerability that stems from the lack of effective detection of .xsl file extensions in the application's file upload feature. An attacker could exploit this...
CVE-2021-45886
An issue was discovered in PONTON X/P Messenger before 3.11.2. Anti-CSRF tokens are globally valid, making the web application vulnerable to a weakened version of CSRF, where an arbitrary token of a low-privileged user such as operator can be used to confirm actions of higher-privileged ones such...
Liblouis 安全漏洞
Liblouis is an open-source Braille translator written in C. It is a very easy to use and easy to use. A security vulnerability exists in Liblouis before 3.21.0. The vulnerability stems from a buffer overflow in compileTranslationTable.c in compilePassOpcode...
CVE-2022-0926
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12...
CVE-2022-0870
Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.5...
CVE-2022-0821
Improper Authorization in GitHub repository orchardcms/orchardcore prior to 1.3.0...
CVE-2022-0697
Open Redirect in GitHub repository archivy/archivy prior to 1.7.0...
CVE-2022-23233
StorageGRID formerly StorageGRID Webscale versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service DoS of the Local Distribution Router LDR service...
CVE-2022-23779
Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses...
Webmin 访问控制错误漏洞
Webmin is the Webmin community's set of Web-based system management tools for Unix-like operating systems. webmin versions prior to 1.990 have an elevation of privilege vulnerability that stems from a faulty program to high-level local procedure calls. An attacker could exploit this vulnerability...
CVE-2022-23911
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statement when retrieving a testimonial to edit, leading to a SQL Injection...
CVE-2022-23912
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting...
CVE-2021-24864
The WP Cloudy, weather plugin WordPress plugin before 4.4.9 does not escape the postid parameter before using it in a SQL statement in the admin dashboard, leading to a SQL Injection issue...
WordPress 跨站脚本漏洞
WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. cross-site scripting vulnerability exists in versions of WordPress WP-Paginate plugin prior to 2.1.4, which stems from the...
CVE-2022-0723
Cross-site Scripting XSS - Reflected in GitHub repository microweber/microweber prior to 1.2.11...
CVE-2022-0763
Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 1.3...
AZL-8862 CVE-2022-23308 affecting package libxml2 for versions less than 2.9.13-1
valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes...
CVE-2022-24341
In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user...
PT-2022-17215 · Fscrypt +1 · Fscrypt +1
Name of the Vulnerable Software and Affected Versions: fscrypt versions prior to 0.3.3 Description: The PAM module for fscrypt does not adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a...