8477 matches found
YAJL 安全漏洞
YAJL is a fast streaming JSON parsing library from the individual developer Lloyd Hilaiel. A security vulnerability exists in YAJL version 2.1.0, which stems from a memory leak using the yajltreeparse function...
golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding
A flaw was found in golang. A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of requests...
PrestaShop SQL注入漏洞
PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, short message alerts and product image scaling. A security vulnerability exists in PrestaShop jmsthemelayout version 2.5.5, which stems from vulnerability t...
WordPress plugin EELV Newsletter 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...
CVE-2023-33764
eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a stored cross-site scripting XSS vulnerability via the component /de/casting/show/detail/...
PrestaShop 路径遍历漏洞
PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution offers multiple payment methods, short message alerts and product image scaling. A security vulnerability exists in PrestaShop tshirtecommerce 2.1.4 and earlier versions, which stems from the...
MP4v2 安全漏洞
MP4v2 is a library for creating, modifying, and reading MP4 files by the individual developer enzo1982. A security vulnerability exists in MP4v2 version v2.1.3, which stems from the discovery of a contained memory leak via the MP4StringProperty class in mp4property.cpp...
PT-2023-14315 · Rancher · Rancher
Name of the Vulnerable Software and Affected Versions: Rancher versions 2.6.0 through 2.6.12 Rancher versions 2.7.0 through 2.7.3 Description: An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' issue allows users in higher-privileged groups to inject code execut...
CVE-2023-2304
The Favorites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userfavorites' shortcode in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...
PT-2023-9952 · Bestwebsoft · Bestwebsoft Twitter Plugin
Name of the Vulnerable Software and Affected Versions: BestWebSoft Twitter Plugin versions up to 2.14 Description: A problematic issue has been found, affecting the twttr settings page function of the twitter.php file in the Settings Page component. This issue leads to cross-site request forgery...
CVE-2023-33216
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in gVectors Team WooDiscuz – WooCommerce Comments woodiscuz-woocommerce-comments allows Stored XSS.This issue affects WooDiscuz – WooCommerce Comments: from n/a through 2.2.9...
DEBIAN-CVE-2023-32681
Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use rebuildproxies to reattach the Proxy-Authorization header to requests. For HTTP connections sent...
MP4v2 资源管理错误漏洞
MP4v2 is a library for creating, modifying, and reading MP4 files by enzo1982 Personal Developer. A security vulnerability exists in MP4v2 version v2.1.2, which originates from a memory leak that can be caused via class MP4BytesProperty...
PT-2023-15057 · Unknown · Kodex Posts Likes Plugin
Name of the Vulnerable Software and Affected Versions: Kodex Posts likes plugin versions = 2.4.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...
CVE-2023-2840
NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2...
DEBIAN-CVE-2023-2837
Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.2...
WordPress Plugin Crayon Syntax Highlighter 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...
WordPress Plugin DNUI 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...
CVE-2023-2717
The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.8. This is due to missing nonce validation on the 'enablesafemode' function. This makes it possible for unauthenticated attackers to enable safe mode, which disables all other...
