golang: net/http: handle server errors after sending GOAWAY

A flaw was found in the golang package. In net/http in Go, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if a fatal error preempts the shutdown...

Adobe Substance 3D Stager 缓冲区错误漏洞

Adobe Substance 3D Stager is a virtual 3D studio from the American company Audobee Adobe. An out-of-bounds read vulnerability exists in Adobe Substance 3D Stager version 2.1.3 and prior versions, which can be exploited by attackers to obtain sensitive information...

CVE-2022-34344

Missing Authorization vulnerability in Rymera Web Co Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More.This issue affects Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles,...

WordPress Plugin WP Crowdfunding Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. The WordPress Plugin WP Crowdfunding...

PT-2024-14014

Name of the Vulnerable Software and Affected Versions savignano S/Notify versions prior to 2.0.1 for Bitbucket Description An issue was discovered that allows the configuration settings of S/Notify to be modified via a CSRF attack while an administrative user is logged on. This could be initiated...

Inis Code Issues Vulnerabilities

Inis is a web application. A code issue vulnerability exists in Inis 2.0.1 and earlier versions, which stems from a server request forgery SSRF vulnerability in the file app/api/controller/default/Proxy.php...

CVE-2023-47559

A cross-site scripting XSS vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: QuMagie 2.2.1 and later...

QNAP Systems QuMagie SQL Injection Vulnerability

QNAP Systems QuMagie is a QTS photo management application from QNAP Systems. A SQL injection vulnerability exists in QNAP Systems QuMagie prior to version 2.2.1, which stems from the presence of a SQL injection vulnerability that could allow an authenticated user to inject malicious code over th...

PT-2024-2651 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.29.3 Envoy versions prior to 1.28.2 Envoy versions prior to 1.27.4 Envoy versions prior to 1.26.8 Description: The HTTP/2 protocol stack in Envoy is vulnerable to CPU exhaustion due to a flood of CONTINUATION frames...

AZL-43807 CVE-2023-6992 affecting package teckit 2.5.9-4

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation deflate.c. The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression...

CVE-2023-6524

The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the map title parameter in all versions up to and including 2.88.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor...

PaddlePaddle Code Issue Vulnerability

PaddlePaddle is an independent R&D deep learning platform open-sourced by China's PaddlePaddle. PaddlePaddle 2.6.0 version of the previous security vulnerability, the vulnerability stems from the possibility of runtime crashes and denial of service...

Cesanta MJS 安全漏洞

Cesanta MJS is an embedded JavaScript engine for C/C++ from Cesanta Ireland. A denial of service vulnerability exists in Cesanta MJS version 2.20.0, which is caused by a flaw in the mjs+0x4ec508 component. An attacker could exploit this vulnerability to cause a denial of service...

PT-2024-15370 · Unknown · Huiran Host Reseller System

Name of the Vulnerable Software and Affected Versions: HuiRan Host Reseller System versions up to 2.0.0 Description: A vulnerability has been found in the HuiRan Host Reseller System, affecting an unknown function of the file /user/index/findpass?do=4 of the component HTTP POST Request Handler...

CVE-2023-39157

Improper Control of Generation of Code 'Code Injection' vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.10...

CVE-2023-50589

Grupo Embras GEOSIAP ERP v2.2.167.02 was discovered to contain a SQL injection vulnerability via the codLogin parameter on the login page...

XnView Classic Security Vulnerability

XnView Classic is a suite of image viewing software. The software can be used to view, convert, organize and edit graphic and video files. A security vulnerability exists in XnView Classic prior to version 2.51.3, which originates from a write access conflict in xnview.exe+0x3125D6...

PT-2023-32883 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 2.10.0 and earlier Description: The issue allows an attacker to perform CSRF attacks against the server due to the failure to sanitize deeplink paths. Recommendations: For Mattermost versions 2.10.0 and earlier, update to ...

CVE-2023-50839

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.1...

CVE-2023-50859

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themeum WP Crowdfunding allows Stored XSS.This issue affects WP Crowdfunding: from n/a through 2.1.6...