Zscaler Client Connector Backlink Vulnerability

Zscaler Client Connector is an application from zscaler. An application that is installed on a device to ensure that Internet traffic and access to an organization's internal applications are secure and in compliance with the organization's policies, even when not on the corporate network. A...

Dreamer CMS Cross-Site Request Forgery Vulnerability

Dreamer CMS is a dreamer content management system by Junnan Wang, an individual developer in China. A security vulnerability exists in Dreamer CMS version v4.1.3. An attacker can exploit this vulnerability to conduct cross-site request forgery CSRF attacks via the component /admin/variable/delet...

Moodle 跨站脚本漏洞

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle that stems from the presence of a cross-site scripting XSS vulnerability. Affected products a...

GHSA-X3CC-X39P-42QX fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name

Impact As a part of this vulnerability, user was able to se code using proto as a tag or attribute name. js const XMLParser, XMLBuilder, XMLValidator = require"fast-xml-parser"; let XMLdata = "hacked" const parser = new XMLParser; let jObj = parser.parseXMLdata; console.logjObj.polluted // should...

CVE-2023-2484

The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

PT-2023-6485 · Iniparser +4 · Iniparser +4

Name of the Vulnerable Software and Affected Versions: iniparser version 4.1 Description: The issue is related to a NULL Pointer Dereference in the iniparser getlongint function, which fails to check for NULL returns from the iniparser getstring function. This can lead to a denial of service...

WordPress plugin Export All URLs 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

GL.iNet MT3000 操作系统命令注入漏洞

The GL.iNet MT3000 is an AX3000 portable router using the Wi-Fi 6 protocol from China's GL.iNet. An operating system command injection vulnerability exists in the GL.iNet MT3000 version 4.1.0, which stems from the presence of operating system command injection...

OESA-2022-1930 netty security update

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. %package help Summary: Documents for Buildarch: noarch Requires: man info Provides: -javadoc = - Obsoletes: -javadoc - %description help Man pages...

WordPress plugin AlgolPlus Advanced Dynamic Pricing for WooCommerce 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2022-29649

Qsmart Next v4.1.2 was discovered to contain a cross-site scripting XSS vulnerability...

TOTOLINK A860R 安全漏洞

The TOTOLINK A860R is a wireless router from China's Gion Electronics TOTOLINK. A security vulnerability exists in the TOTOLINK A860R version V4.1.2cu.5182B20201027, which originates from an unfiltered parameter in infostat.cgi, resulting in a buffer overflow...

TOTOLINK A800R 信任管理问题漏洞

The TOTOLINK A800R is a wireless router from China's Gion Electronics TOTOLINK. A security vulnerability exists in the TOTOLINK A800R version V4.1.2cu.5137B20200730, which originates from the inclusion of a hardcoded password for root in /etc/shadow.sample...

kkFileView 跨站脚本漏洞

Keking kkFileView is a Spring-Boot project for online previewing of documents by Keking Technology Keking. A cross-site scripting vulnerability exists in kkFileView v4.1.0, which originates from multiple cross-site scripts in the urls and currentUrl parameters of the...

Apache OpenOffice 安全特征问题特征问题漏洞

Apache OpenOffice is an open source office software suite from the U.S. Apache Apache Foundation. The suite contains text documents, spreadsheets, presentations, drawings, databases and more. A security feature issue vulnerability exists in Apache OpenOffice versions prior to 4.1.13, which stems...

PT-2022-21073 · Totolink · Totolink T6

Name of the Vulnerable Software and Affected Versions: TOTOLINK T6 version 4.1.9cu.5179 B20201015 Description: A stack overflow issue was discovered via the url parameter in the function FUN 00418540. This issue can be exploited, potentially leading to unintended consequences. Recommendations: Fo...

Admidio 跨站脚本漏洞

Admidio is an open source member management system from the Admidio team. The system supports member lists, event management, guestbooks, photo albums and downloads. A cross-site scripting vulnerability exists in Admidio version 4.1.2, which stems from the program's lack of checksum filtering of...

CodeIgniter 跨站请求伪造漏洞

CodeIgniter is an open source web framework written in PHP. A cross-site request forgery vulnerability exists in CodeIgniter because the product does not validate user identity. The vulnerability can be exploited to send unintended requests to the server. The following products and versions are...

CVE-2020-28103

cscms v4.1 allows for SQL injection via the "pagedel" function...

DEBIAN-CVE-2022-21664

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of the classes, there's potential for unintended SQL queries to be executed. This has been patched in WordPress version 5.8.3. Older affected...