8821 matches found
Modex 资源管理错误漏洞
Modex is a model extractor. It is used to mechanically extract validation models from implementation-level C code. a security vulnerability exists in Modex, which stems from the discovery via component tcache that Modex v2.11 contains a Use-After-Free vulnerability. No details of the vulnerabilit...
CVE-2021-42562
An issue was discovered in CALDERA 2.8.1. It does not properly segregate user privileges, resulting in non-admin users having access to read and modify configuration or other components that should only be accessible by admin users...
CVE-2021-28377
ChronoForums 2.0.11 allows av Directory Traversal to read arbitrary files...
AZL-7160 CVE-2022-22826 affecting package expat for versions less than 2.4.3-1
nextScaffoldPart in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow...
DEBIAN-CVE-2022-22826
nextScaffoldPart in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow...
DEBIAN-CVE-2022-22823
buildmodel in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow...
CVE-2021-42748
In Beaver Builder through 2.5.0.3, attackers can bypass the visibility controls protection mechanism via the REST API...
PT-2022-1586
Name of the Vulnerable Software and Affected Versions Expat aka libexpat versions prior to 2.4.3 Description The issue is related to an integer overflow in the lookup function of the xmlparse.c file in the Expat library. This can potentially allow a remote attacker to cause a denial of service...
UBUNTU-CVE-2021-43779
GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server's underlying operating system using command injection abuse of...
haproxy: does not ensure that the scheme and path portions of a URI have the expected characters
A flaw was found in haproxy. An input validation flaw when processing HTTP/2 requests causes haproxy to not ensure that the scheme and path portions of a URI have the expected characters. This may cause specially crafted input to bypass implemented security restrictions. The highest threat from...
CVE-2022-22109
In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting XSS vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they open the “/tasks” page to view all the...
Latte 跨站脚本漏洞
Latte is a template engine for Nette Foundation's Php. Latte in version 2.8.0 contains a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and output. An attacker could exploit this vulnerability to execute JavaScript code on the client...
DEBIAN-CVE-2021-44716
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests...
AZL-35004 CVE-2021-44716 affecting package moby-engine for versions less than 25.0.3-1
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests...
AZL-33638 CVE-2021-44716 affecting package prometheus-process-exporter for versions less than 0.7.10-19
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests...
AZL-33641 CVE-2021-44716 affecting package rook for versions less than 1.6.2-19
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests...
UBUNTU-CVE-2021-44716
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests...
Rust libpulse-binding crate 安全漏洞
Rust libpulse-binding crate is the repository that contains sys FFI and binding libraries crates for connecting to PulseAudio PA from the Rust programming language. A security vulnerability exists in Rust libpulse-binding crate versions prior to 2.6.0, which stems from a boundary error in the...
WordPress 插件跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the Smart...