Drupal 安全漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal Views SVG Animation prior to version 1.0.1, which stems from improper input neutralization during page generation, resulting in a cross-site scriptin...

WordPress VR Views plugin <= 1.5.1 - Stored Cross Site Scripting (XSS) vulnerability

Stored Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 Patchstack Alliance in WordPress Plugin VR Views versions = 1.5.1...

CVE-2024-40749

Improper Access Controls allows access to protected views...

CVE-2024-40749 [20250103] - Core - Read ACL violation in multiple core views

Improper Access Controls allows access to protected views...

CVE-2024-40749

The CVE-2024-40749 entry concerns Joomla! core: an improper access control (ACL) read-violation that allows access to protected core views. The incident is described as affecting multiple core views via an ACL leakage, with a CVSS v3.1 base score of 7.5 (Network access, no user interaction requir...

CVE-2024-40749 [20250103] - Core - Read ACL violation in multiple core views

Improper Access Controls allows access to protected views...

postgresql security update

9.2.24-9.0.1 - Backport fix for CVE-2023-7348 Orabug: 37220738 - Adds restriction on non-system views...

WordPress plugin Posts and Products Views for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2024-17597 · WordPress · Posts/Products Views For Woocommerce

Name of the Vulnerable Software and Affected Versions: Posts and Products Views for WooCommerce plugin for WordPress versions up to, and including, 2.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'papvfwc views' shortcode due to insufficient input sanitizatio...

postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes

A flaw was found in PostgreSQL. This vulnerability allows incorrect row-level security policies to be applied via subqueries, WITH queries, security invoker views, or SQL-language functions that reference tables with row-level security policies. This issue arises when a query is planned under one...

postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes

A flaw was found in PostgreSQL. This vulnerability allows incorrect row-level security policies to be applied via subqueries, WITH queries, security invoker views, or SQL-language functions that reference tables with row-level security policies. This issue arises when a query is planned under one...

VulnCheck KEV: CVE-2024-45388

Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The /api/v2/simulation POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary...

postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes

A flaw was found in PostgreSQL. This vulnerability allows incorrect row-level security policies to be applied via subqueries, WITH queries, security invoker views, or SQL-language functions that reference tables with row-level security policies. This issue arises when a query is planned under one...

CVE-2024-49581

Restricted Views backed objects OSV1 could be bypassed under specific circumstances due to a software bug, this could have allowed users that didn't have permission to see such objects to view them via Object Explorer directly. This software bug did not impact or otherwise make data available...

CVE-2024-49581

CVE-2024-49581 affects Palantir Foundry (Apollo-managed Foundry instances). A software bug in Restricted Views backed objects (OSV1) could be bypassed under specific circumstances, allowing users without permission to view such objects via the Object Explorer. The issue did not enable cross-organ...

CVE-2023-2142 Nunjucks autoescape bypass leads to cross site scripting

In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash ...

The vulnerability of the Views component in Google Chrome allows a hacker to escape from an isolated environment.

The vulnerability of the Views component in Google Chrome is related to improper implementation. Exploiting this vulnerability can allow an attacker to escape from a isolated environment using a specially crafted HTML page...

AXIS Camera Station Pro 安全漏洞

AXIS Camera Station Pro is a powerful and flexible video management and access control from Axis Sweden. A security vulnerability exists in AXIS Camera Station Pro versions prior to 6.4, which stems from a client-side-only check and therefore allows editing and deletion of views without the...

Astra Linux – Vulnerability in PostgresSQL-15

Lack of authorization in PostgreSQL’s built-in views, pgstatsext and pgstatsextexprs, allows a non-privileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. These common values may reveal column values that the eavesdropper would...

OPENSUSE-SU-2024:0374-1 Security update for chromium

This update for chromium fixes the following issues: Chromium 131.0.6778.69 stable released 2024-11-12 boo1233311 CVE-2024-11110: Inappropriate implementation in Blink. CVE-2024-11111: Inappropriate implementation in Autofill. CVE-2024-11112: Use after free in Media. CVE-2024-11113: Use after fre...