541 matches found
PT-2023-2564 · Illumina · Illumina Universal Copy Service
Name of the Vulnerable Software and Affected Versions: Illumina Universal Copy Service versions 2.x Description: The issue is related to the binding of Illumina Universal Copy Service to an unrestricted IP address, allowing an unauthenticated malicious actor to use the service to listen on all IP...
Dell Display Manager 安全漏洞
Dell Display Manager is a Windows application from Dell, Inc. It is used to manage a monitor or a group of monitors. A security vulnerability exists in Dell Display Manager version 2.1.0 and prior versions. An attacker could exploit this vulnerability to execute arbitrary code...
PT-2023-6335 · Adobe · Substance3D - Stager
Name of the Vulnerable Software and Affected Versions: Adobe Substance 3D Stager versions 2.0.1 and earlier Description: The issue is related to a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires use...
WordPress plugin Simple Giveaways 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...
PT-2023-19356 · Link Software Llc · Wp Terms Popup
Name of the Vulnerable Software and Affected Versions: Link Software LLC WP Terms Popup plugin versions = 2.6.0 Description: The issue is related to an Authenticated admin+ Cross-Site Scripting XSS vulnerability. This means that an attacker with administrative access could potentially inject...
Apache OpenMeetings 访问控制错误漏洞
Apache OpenMeetings is a multilingual, customizable video conferencing and collaboration system from the Apache Foundation. The product supports audio, video and allows users to view each participant's desktop, among other things. An access control error vulnerability exists in Apache OpenMeeting...
Hgiga Oaklouds 代码问题漏洞
Hgiga Oaklouds is an enterprise collaborative work portal network of China Henderson Technology Hgiga Company. It is used for just-in-time communication and resource reservation. A code issue vulnerability exists in HGiga OAKlouds version v2 and v3. The vulnerability stems from the presence of a...
PT-2023-21902 · Jenkins · Jenkins Phabricator Differential Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Phabricator Differential Plugin versions 2.1.5 and earlier Description: The issue is related to the configuration of the XML parser, which does not prevent XML external entity XXE attacks. This allows attackers who can control coverag...
SUSE CVE-2004-0796
SpamAssassin 2.5x, and 2.6x before 2.64, allows remote attackers to cause a denial of service via certain malformed messages...
SUSE CVE-2005-0173
squidldapauth in Squid 2.5 and earlier allows remote authenticated users to bypass username-based Access Control Lists ACLs via a username with a space at the beginning or end, which is ignored by the LDAP server...
SUSE CVE-2011-3669
Cross-site request forgery CSRF vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2rc1 allows remote attackers to hijack the authentication of arbitrary users for requests that upload attachments...
SUSE CVE-2014-5326
Cross-site scripting XSS vulnerability in Direct Web Remoting DWR through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
SUSE CVE-2016-8643
In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services...
SUSE CVE-2017-11408
In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the AMQP dissector could crash. This was addressed in epan/dissectors/packet-amqp.c by checking for successful list dissection...
SUSE CVE-2018-11776
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true either by user or a plugin like Convention Plugin and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace...
SUSE CVE-2019-3812
QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2cddc function. A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the host...
SUSE CVE-2020-1738
A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branch...
SUSE CVE-2020-10684
A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansiblefacts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansiblefacts after the clean. An attacker could take advantag...
SUSE CVE-2020-36382
OpenVPN Access Server 2.7.3 to 2.8.7 allows remote attackers to trigger an assert during the user authentication phase via incorrect authentication token data in an early phase of the user authentication resulting in a denial of service...