4722 matches found
OpenShift: Missing HTTP Strict Transport Security
Openshift 4.9 does not use HTTP Strict Transport Security HSTS which may allow man-in-the-middle MITM attacks...
PT-2023-18391 · M-Filter · M-Filter
Name of the Vulnerable Software and Affected Versions: m-FILTER versions prior to 5.70R01 Ver.5 Series m-FILTER versions prior to 4.87R04 Ver.4 Series Description: The issue allows a remote unauthenticated attacker to bypass authentication and send users' unintended email when email is being sent...
CVE-2022-4477
The Smash Balloon Social Post Feed WordPress plugin before 4.1.6 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in...
CVE-2022-36441
An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The Gboard used by different applications can be used to launch and use several other applications that are restricted by the admin...
globalpom-utils 安全漏洞
globalpom-utils is the module that contains the global POM utility. A security vulnerability exists in globalpom-utils versions prior to 4.5.1, which stems from the file globalpomutils-fileresources/src/main/java/com/anrisoftware/globalpom/fileresourcemanager/ A problem with the function...
CVE-2022-43271
Inhabit Systems Pty Ltd Move CRM version 4, build 260 was discovered to contain a cross-site scripting XSS vulnerability via the User profile component...
CVE-2022-45942
A Remote Code Execution RCE vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4...
CVE-2022-4501
The Mega Addons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the vcsavingdata function in versions up to, and including, 4.2.7. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to update the plugin'...
CVE-2022-44575
A vulnerability has been identified in PLM Help Server V4.2 All versions. A reflected cross-site scripting XSS vulnerability exists in the web interface of the affected application that could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link...
PT-2022-27253 · Unknown · Plm Help Server V4.2
Name of the Vulnerable Software and Affected Versions: PLM Help Server V4.2 All versions Description: A reflected cross-site scripting XSS vulnerability exists in the web interface of the affected application. This could allow an attacker to execute malicious javascript code by tricking users int...
Passport-wsfed-saml2 安全漏洞
Passport-wsfed-saml2 is an Auth0 open source token authentication provider. A security vulnerability exists in Passport-wsfed-saml2 version 4.6.2 and earlier, which can be exploited by an attacker to bypass WSFed authentication on a website using passport-wsfed-saml2...
PT-2022-25177 · WordPress · Donation Button Wordpress Plugin
Name of the Vulnerable Software and Affected Versions: Donation Button WordPress plugin versions prior to 4.0.1 Description: The issue allows users with a role as low as Contributor to perform Cross-Site Scripting attacks due to the plugin's failure to sanitize and escape some parameters...
PT-2022-36284 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.156 Description: The issue is related to a possible memory leak caused by a missing pci dev put call. This problem was introduced in version v4.4 and is fixed in Linux Kernel version v5.10.156. The actual...
PT-2022-24711
Name of the Vulnerable Software and Affected Versions Clerk WordPress plugin versions prior to 4.0.0 Description The issue affects the validation function for all API requests, making it vulnerable to time-based attacks due to the usage of comparison operators to verify API keys against the ones...
CVE-2022-44354
SolarView Compact 4.0 and 5.0 is vulnerable to Unrestricted File Upload via a crafted php file...
silverstripe framework 跨站脚本漏洞
silverstripe framework is a CMS website framework. A security vulnerability exists in silverstripe framework version 4.11 and earlier versions. An attacker can exploit this vulnerability to conduct cross-site scripting attacks...
PT-2022-24417 · Silverstripe · Silverstripe/Framework
Name of the Vulnerable Software and Affected Versions: Silverstripe silverstripe/framework versions 4.11 and earlier Description: The issue allows an attacker to inject a XSS payload in a Silverstripe CMS response by carefully crafting a return URL on a "/dev/build" or "/Security/login" request. ...
OPENSUSE-SU-2022:10207-1 Security update for tumbler
This update for tumbler fixes the following issues: tumbler was updated to version 4.16.1 boo1205210 gst-thumbnailer: Add mime type check gxoxfce/tumbler65 desktop-thumbnailer: Guard against null path Fix typo in gthread version gxoxfce/tumbler!14...
OPENSUSE-SU-2022:10206-1 Security update for tumbler
This update for tumbler fixes the following issues: tumbler was updated to version 4.16.1 boo1205210 gst-thumbnailer: Add mime type check gxoxfce/tumbler65 desktop-thumbnailer: Guard against null path Fix typo in gthread version gxoxfce/tumbler!14 - Add Recommends: ffmpegthumbnailer...