CVE-2022-25242

In FileCloud before 21.3, file upload is not protected against Cross-Site Request Forgery CSRF...

AZL-8604 CVE-2022-25236 affecting package expat for versions less than 2.4.8-1

xmlparse.c in Expat aka libexpat before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs...

Expat 输入验证错误漏洞

Expat is a fast streaming XML parser written in C. A security vulnerability existed prior to Expat 2.4.5, which could be exploited by attackers to insert namespace separators into namespace URIs...

CVE-2022-0596

Improper Validation of Specified Quantity in Input in Packagist microweber/microweber prior to 1.2.11...

CVE-2022-0589

Cross-site Scripting XSS - Stored in Packagist librenms/librenms prior to 22.1.0...

PT-2022-17135 · Jenkins · Jenkins Autonomiq Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins autonomiq Plugin versions 1.15 and earlier Description: A missing permission check in the Jenkins autonomiq Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified...

PT-2022-17126 · Hashicorp +1 · Jenkins Hashicorp Vault Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins HashiCorp Vault Plugin versions 3.8.0 and earlier Description: The issue allows agent processes to retrieve any Vault secrets for use on the agent. Attackers able to control agent processes can obtain Vault secrets for an...

CVE-2022-0575

Cross-site Scripting XSS - Stored in Packagist librenms/librenms prior to 22.2.0...

CVE-2022-0570

Heap-based Buffer Overflow in Homebrew mruby prior to 3.2...

CVE-2022-0208

The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error message, leading to a Reflected Cross-Site Scripting...

CVE-2021-25115

The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting XSS. Error log content was handled improperly, therefore any user, even unauthenticated, could cause arbitrary javascript to be executed in the admin panel...

CVE-2021-25014

The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ivesavegeneralsettings AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings which could lead to Stored Cross-Site Scripting issue...

WordPress和WordPress plugin SQL注入漏洞

WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers.A SQL injection vulnerability exists in versions prior to WordPress Ad Invalid Click Protector AICP plugin 1.2.6, which stems from ...

IBM Cognos Analytics 跨站脚本漏洞

IBM Cognos Analytics is a suite of business intelligence software from IBM Corporation. IBM Cognos Analytics Mobile for Android is vulnerable to cross-site scripting, which originates from IBM Cognos Analytics Mobile before version 1.1.14. Android applications are vulnerable to cross-site scripti...

CVE-2022-0116

Inappropriate implementation in Compositing in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

CVE-2022-0105

Use after free in PDF Accessibility in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

CVE-2022-0098

Use after free in Screen Capture in Google Chrome on Chrome OS prior to 97.0.4692.71 allowed an attacker who convinced a user to perform specific user gestures to potentially exploit heap corruption via specific user gestures...

GHSA-G8JJ-899Q-8X3J Cross-site scripting in json-sanitizer

OWASP json-sanitizer before 1.2.1 allows XSS. An attacker who controls a substring of the input JSON, and controls another substring adjacent to a SCRIPT element in which the output is embedded as JavaScript, may be able to confuse the HTML parser as to where the SCRIPT element ends, and cause...

CVE-2022-21205

Improper restriction of XML external entity reference in DSP Builder Pro for IntelR QuartusR Prime Pro Edition before version 21.3 may allow an unauthenticated user to potentially enable information disclosure via network access...

CVE-2021-44454

Improper input validation in a third-party component for IntelR QuartusR Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable escalation of privilege via local access...