[SECURITY] Fedora 35 Update: golang-github-rickb777-date-1.15.3-4.fc35

A Go package for working with dates...

Oracle MySQL 输入验证错误漏洞

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. An input validation error vulnerability exists in Oracle MySQL 8.0.29 and prior versions, which originated when an attacker with elevated privileges...

CVE-2022-2169: Improper Neutralization of Input During Web Page Generation

The Loading Page with Loading Screen WordPress plugin before 1.0.83 does not escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-15041

Name of the Vulnerable Software and Affected Versions The Loading Page with Loading Screen WordPress plugin versions prior to 1.0.83 Description The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks due to the plugin not escaping its settings. This can occ...

PT-2022-19892

Name of the Vulnerable Software and Affected Versions CP-8000 MASTER MODULE WITH I/O -25/+70°C versions prior to CPC80 V16.30 CP-8000 MASTER MODULE WITH I/O -40/+70°C versions prior to CPC80 V16.30 CP-8021 MASTER MODULE versions prior to CPC80 V16.30 CP-8022 MASTER MODULE WITH GPRS versions prior...

edinburghcastleapartments.com Cross Site Scripting vulnerability OBB-2738311

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

DEBIAN-CVE-2022-26365

Linux disk/nic frontends data leaks This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend CVE-2022-26365,...

ALPINE-CVE-2022-33740

Linux disk/nic frontends data leaks This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend CVE-2022-26365,...

PT-2022-22343 · Jenkins · Jenkins Validating Email Parameter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Validating Email Parameter Plugin versions 1.10 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability. This is due to the plugin not escaping the name and description of its parameter type...

Stored XSS vulnerability in validating-email-parameter

validating-email-parameter 1.10 and earlier does not escape the name and description of its parameter type. Additionally, it disables the security hardening added in Jenkins 2.44 and LTS 2.32.2 as part of the SECURITY-353 / CVE-2017-2601 fix that protects the "Build With Parameters" and...

Miscompilation of `i8x16.swizzle` and `select` with v128 inputs

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqwc-c49r-4w2x. For more information see the GitHub-hosted security advisory...

CVE-2022-1994

CVE-2022-1994 concerns the Google Authenticator WordPress plugin (

PT-2022-14246

Name of the Vulnerable Software and Affected Versions Login With OTP Over SMS, Email, WhatsApp and Google Authenticator WordPress plugin versions prior to 1.0.8 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks, even when the unfiltered htm...

CVE-2022-1994: Improper Neutralization of Input During Web Page Generation

The Login With OTP Over SMS, Email, WhatsApp and Google Authenticator WordPress plugin before 1.0.8 does not escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

Prototype Pollution

Overview @loopback/rest is a The REST API package for loopback-next Affected versions of this package are vulnerable to Prototype Pollution via JSON payloads containing constructor. Details Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to...

Cross-site Scripting in Jenkins Readonly Parameter Plugin

Jenkins Readonly Parameter Plugin 1.0.0 and earlier does not escape the name and description of Readonly String and Readonly Text parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

PT-2022-22053 · Jenkins · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins Date Parameter Plugin versions 0.0.4 and earlier Description: The issue is a stored cross-site scripting XSS vulnerability that occurs because the Jenkins Date Parameter Plugin does not escape the name and description of Date paramete...

PT-2022-22066 · Jenkins · Jenkins Sauce Ondemand Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Sauce OnDemand Plugin versions 1.204 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability, which can be exploited by attackers with Item/Configure permission. This occurs because the plugin doe...

PT-2022-22052 · Jenkins · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins CRX Content Package Deployer Plugin versions 1.9 and earlier Description: The issue is a stored cross-site scripting XSS vulnerability that occurs because the plugin does not escape the name and description of CRX Content Package Choi...

Stored XSS vulnerabilities in multiple plugins providing additional parameter types

Multiple plugins do not escape the name and description of the parameter types they provide: Agent Server Parameter 1.1 and earlier SECURITY-2731 / CVE-2022-34183 CRX Content Package Deployer 1.9 and earlier SECURITY-2727 / CVE-2022-34184 Date Parameter Plugin 0.0.4 and earlier SECURITY-2711 /...