SUSE CVE-2010-2536

Multiple cross-site scripting XSS vulnerabilities in rekonq 0.5 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 a URL associated with a nonexistent domain name, related to webpage.cpp, aka a "universal XSS" issue; 2 unspecified vectors related to webview.cpp; and t...

SUSE CVE-2011-2929

The template selection functionality in actionpack/lib/actionview/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a crafted URL, related to a "filter skipping...

SUSE CVE-2013-2214

status.cgi in Nagios 4.0 before 4.0 beta4 and 3.x before 3.5.1 does not properly restrict access to certain users that are a contact for a service, which allows remote authenticated users to obtain sensitive information about hostnames via the servicegroup 1 overview, 2 summary, or 3 grid style i...

SUSE CVE-2016-1700

extensions/renderer/runtimecustombindings.cc in Google Chrome before 51.0.2704.79 does not consider side effects during creation of an array of extension views, which allows remote attackers to cause a denial of service use-after-free or possibly have unspecified other impact via vectors related ...

SUSE CVE-2016-6212

The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated users to bypass intended access restrictions and obtain sensitive Statistics information via unspecified vectors...

SUSE CVE-2017-15576

Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information...

SUSE CVE-2019-19645

alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements...

SUSE CVE-2022-2481

Use after free in Views in Google Chrome prior to 103.0.5060.134 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via UI interaction...

How to Configure GSLB Setup for Internal Users From GUI

This article contains information about how to configure a GSLB setup for internal users using the same host name. In some scenarios, the administrator requires that all external users coming through the Internet must go through the Citrix Gateway using a public or external IP Address, whereas al...

Information disclosure

A vulnerability was found in paxswill EVE Ship Replacement Program 0.12.11. It has been rated as problematic. This issue affects some unknown processing of the file src/evesrp/views/api.py of the component User Information Handler. The manipulation leads to information disclosure. The attack may ...

WordPress Post Views Count (Support caching plugins!) Plugin <= 3.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Post Views Count Support caching plugins! Type Plugin Vulnerable versions = 3.0.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4761 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 88e7e24c675b...

PT-2023-10239 · Unknown · Mnbikeways Database

Name of the Vulnerable Software and Affected Versions: MNBikeways database affected versions not specified Description: A critical issue was found in the MNBikeways database, affecting the processing of the file Data/views.py. The manipulation of the id1/id2 argument leads to SQL injection...

PT-2023-10235 · Vinylmap · Vinylmap

Name of the Vulnerable Software and Affected Versions: vinylmap version 2071174A Description: A critical issue has been found, affecting the contact function of the file recordstoreapp/views.py. This issue leads to sql injection. Recommendations: Apply the patch...

Vinylmaps SQL注入漏洞

Vinylmaps is a search engine for vinyl records by the individual developer of 2071174A. Vinylmaps suffers from an SQL injection vulnerability that stems from a security issue in the function contact in the file recordstoreapp/views.py, which leads to SQL injection...

CVE-2023-0293

The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to chan...

CVE-2023-0293 Mediamatic – Media Library Folders <= 2.8.1 - Missing Authorization

The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to chan...

Happy 20th Birthday TaoSecurity Blog

Happy 20th birthday TaoSecurity Blog, born on 8 January 2003. Thank you Blogger Blogger now part of Google has continuously hosted this blog for 20 years, for free. I'd like to thank Blogger and Google for providing this platform for two decades. It's tough to find extant self-hosted security...

CVE-2019-25090

A vulnerability was found in FreePBX arimanager up to 13.0.5.3 and classified as problematic. Affected by this issue is some unknown functionality of the component Views Handler. The manipulation of the argument dataurl leads to cross site scripting. The attack may be launched remotely. Upgrading...

GHSA-8QWH-RM6C-JV96 Oxidized Web vulnerable to Cross-site Scripting

A vulnerability was found in ytti Oxidized Web. It has been classified as problematic. Affected is an unknown function of the file lib/oxidized/web/views/confsearch.haml. The manipulation of the argument toresearch leads to cross site scripting. It is possible to launch the attack remotely. The...

PT-2022-8302 · Freepbx · Freepbx

Name of the Vulnerable Software and Affected Versions: FreePBX arimanager versions up to 13.0.5.3 Description: A vulnerability was found in the Views Handler component of FreePBX arimanager, which can be exploited through the manipulation of the dataurl argument, leading to cross-site scripting...