UBUNTU-CVE-2015-10005

A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/htmlre.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is able to address this issue. The name of t...

PT-2022-9019 · Ahorner · Text-Helpers

Name of the Vulnerable Software and Affected Versions: ahorner text-helpers versions up to 1.0.x ahorner text-helpers versions 1.1.0 through 1.1.1 Description: A critical issue affects the unknown code of the file lib/text helpers/translation.rb. The manipulation of the link argument leads to the...

PT-2022-16071 · Unknown · Codeigniter

Name of the Vulnerable Software and Affected Versions: CodeIgniter versions prior to 4.2.11 Description: This issue may allow attackers to spoof their IP address when the server is behind a reverse proxy. Recommendations: For versions prior to 4.2.11, upgrade to version 4.2.11 or later, and...

PT-2022-16061

Name of the Vulnerable Software and Affected Versions jsonwebtoken versions =8.5.1 Description The issue arises from the lack of algorithm definition in the jwt.verify function, leading to a signature validation bypass due to defaulting to the none algorithm for signature verification. This occur...

CVE-2021-4268 phpRedisAdmin cross-site request forgery

A vulnerability, which was classified as problematic, was found in phpRedisAdmin up to 1.17.3. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.18.0 is able to address this issue. The name of...

PT-2022-11659 · Webdetails · Webdetails Cpf

Name of the Vulnerable Software and Affected Versions: Webdetails cpf versions up to 9.5.0.0-80 Description: A vulnerability has been found in Webdetails cpf, where the manipulation of the baseUrl argument leads to cross-site scripting. This issue can be launched remotely. Recommendations: For...

PT-2022-17590 · Vm2 · Vm2

Name of the Vulnerable Software and Affected Versions: vm2 versions prior to 3.9.10 Description: The issue is related to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. This allows access to a host object and can lead to a sandbox compromise...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function. PoC javascript var wiscan = require'mt7688-wiscan'; wiscan.scan';touch EXPLOITED;', function; Remediation Upgrade mt7688-wiscan to version 0.8.3 or...

Remote Code Execution (RCE)

Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Remote Code Execution RCE via the clone, pull, push and listRemote methods, due to improper input sanitization. This vulnerability exists due to...

PT-2022-16063 · Openfga · Openfga

Name of the Vulnerable Software and Affected Versions: OpenFGA version 0.3.0 Description: OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA is vulnerable to authorization bypas...

CVE-2022-40743 Apache Traffic Server: Security issues with the xdebug plugin

Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache poisoning attacks.This issue affects Apache Traffic Server: 9.0.0 to 9.1.3. Users should upgrade to 9.1.4 or later versions...

UBUNTU-CVE-2021-4249

A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack...

PT-2022-27676 · Unknown · Mschaef Toto

Name of the Vulnerable Software and Affected Versions: mschaef toto versions up to 1.4.20 Description: A vulnerability was found in the Todo List Handler component, which can be exploited remotely. The manipulation leads to cross-site scripting. It is recommended to upgrade the affected component...

CVE-2022-46870 Apache Zeppelin: Stored XSS in note permissions

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Zeppelin allows logged-in users to execute arbitrary javascript in other users' browsers. This issue affects Apache Zeppelin before 0.8.2. Users are recommended to upgrade to a supported...

CVE-2022-4525

A vulnerability has been found in National Sleep Research Resource sleepdata.org up to 58.x and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 59.0.0.r...

Cross site scripting

A vulnerability has been found in National Sleep Research Resource sleepdata.org up to 58.x and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 59.0.0.r...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

CVE-2022-4522 CalendarXP cross site scripting

A vulnerability classified as problematic was found in CalendarXP up to 10.0.1. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 10.0.2 is able to address this issue. The name of the patch is...

DEBIAN-CVE-2022-23517

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a...

DEBIAN-CVE-2019-25078

A vulnerability classified as problematic was found in pacparser up to 1.3.x. Affected by this vulnerability is the function pacparserfindproxy of the file src/pacparser.c. The manipulation of the argument url leads to buffer overflow. Attacking locally is a requirement. Upgrading to version 1.4....