WordPress plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress WP Booking System plugin has a cross-site scripting vulnerability in versions prior to 2.0.15...

GHSA-JRH2-HC4R-7JWX Directory-traversal in Django

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it...

AZL-7156 CVE-2022-22822 affecting package expat for versions less than 2.4.3-1

addBinding in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow...

CVE-2021-45452

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it...

AZL-33616 CVE-2021-44716 affecting package moby-cli for versions less than 20.10.27-5

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests...

AZL-8964 CVE-2021-45957 affecting package dnsmasq for versions less than 2.89-2

Dnsmasq 2.86 has a heap-based buffer overflow in answerrequest called from FuzzAnswerTheRequest and fuzzrfc1035.c. NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 "do not represent real vulnerabilities, to the best of our knowledge...

Rust 安全漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation.A security vulnerability exists in versions of Mozilla Rust molecule crate prior to 0.7.2, which stems from incorrect results read by FixVec. No details of the vulnerability are currently available...

CVE-2021-45648

Certain NETGEAR devices are affected by disclosure of sensitive information. This affects EX6100v2 before 1.0.1.106, EX6150v2 before 1.0.1.106, EX6250 before 1.0.0.146, EX6400 before 1.0.2.164, EX6400v2 before 1.0.0.146, EX6410 before 1.0.0.146, EX6420 before 1.0.0.146, EX7300 before 1.0.2.164,...

Rust rusqlite crate 资源管理错误漏洞

Rust rusqlite crate is an ergonomic wrapper for using SQLite from Rust. it attempts to expose a rust-postgres-like interface. versions 0.25.x prior to 0.25.4 and 0.26.x prior to 0.26.2 of Rust rusqlite crate are vulnerable to security vulnerability, which stems from a resource management error in...

Netgear NETGEAR 命令注入漏洞

Netgear NETGEAR is a router from the American company Netgear. A hardware device that connects two or more networks and acts as a gateway between networks. A security vulnerability exists in certain NETGEAR devices that stems from the fact that some NETGEAR devices are vulnerable to command...

Netgear NETGEAR R6400 注入漏洞

The Netgear NETGEAR R6400 is a wireless router from Netgear, Inc. An injection vulnerability exists in NETGEAR R6400 devices prior to version 1.0.1.70, which is affected by server-side injection...

CVE-2021-20874

Incorrect permission assignment for critical resource vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows a remote unauthenticated attacker to access arbitrary files on the server and obtain...

Apple Remote Desktop 加密问题漏洞

Apple Remote Desktop is a remote desktop feature from Apple. A security vulnerability exists in Apple Remote Desktop versions prior to 3.9, which can be exploited by an attacker to capture plaintext passwords...

PrestaShop 跨站脚本漏洞

Prestashop is a set of open source e-commerce solutions from the United States Prestashop. The solution provides multiple payment methods, short message alerts and product image scaling. A security vulnerability exists in PrestaShop that stems from PrestaShop before 1.5.2 that allows XSS via the...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress icegram plugin in versions prior to 2.0.5 has a...

PT-2021-22238 · Jfrog · Jfrog Artifactory

Name of the Vulnerable Software and Affected Versions: JFrog Artifactory versions prior to 7.25.4 Description: The issue is related to Blind SQL Injection, which can be exploited by a low-privileged authenticated user due to incomplete validation when performing an SQL query. Recommendations: For...

CVE-2021-43812

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. Users are advised to upgrade as soon as...

CVE-2021-42027

A vulnerability has been identified in SINUMERIK Edge All versions V3.2. The affected software does not properly validate the server certificate when initiating a TLS connection. This could allow an attacker to spoof a trusted entity by interfering in the communication path between the client and...

UBUNTU-CVE-2021-39937

A collision in access memoization logic in all versions of GitLab CE/EE before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, leads to potential elevated privileges in groups and projects under rare circumstances...

CVE-2021-20866

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors...