UBUNTU-CVE-2024-28184

WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if urlfetcher is configured to prevent access to files and URLs. This vulnerability has been patched in...

CVE-2024-28157

Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs...

PT-2024-22303

Name of the Vulnerable Software and Affected Versions Jenkins GitBucket Plugin versions 0.8 and earlier Description The issue is related to a stored cross-site scripting XSS vulnerability. This occurs because Gitbucket URLs on build views are not properly sanitized, allowing attackers who can...

Liferay Portal and Liferay DXP Security Vulnerabilities

Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...

The vulnerability of the Authentication Token Handler component in the IntelliJ IDEA integrated development environment allows a attacker to send the authentication token to any arbitrary URL.

The vulnerability of the Authentication Token Handler component in the IntelliJ IDEA integrated development environment exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to send authentication tokens to any specified URL...

PT-2024-21316 · Ebm Technologies · Ebm Technologies Risweb

Name of the Vulnerable Software and Affected Versions: EBM Technologies RISWEB affected versions not specified Description: The issue concerns a lack of proper permission control for specific URL paths in EBM Technologies RISWEB, allowing attackers to browse certain pages and query sensitive data...

The vulnerability of the XWiki platform for creating collaborative web applications lies in the insufficient verification of the authenticity of executed queries. This allows attackers to obtain the rights of the current user.

The vulnerability of the XWiki Platform lies in the insufficient verification of the authenticity of executed queries. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain the privileges of the current user through a specially created URL...

PT-2024-1694 · Jetbrains · Jetbrains Intellij Idea

Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to 2023.3.3 Description: The issue exists due to insufficient input validation in the authentication token handler component of the integrated development environment. This could allow a remote attacker ...

The vulnerability of the WSGI-server microprogramming software for Network Attached Storage devices NAS326 and NAS542 allows a hacker to inject commands into the basic operating system.

The vulnerability of the WSGI-server microprogramming system for Network Attached Storage devices NAS326 and NAS542 is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows an attacker to inject commands...

PT-2024-19047 · Tp Link · Tp-Link

Name of the Vulnerable Software and Affected Versions: TP-LINK products affected versions not specified Description: The issue allows a network-adjacent unauthenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commands on the product that has...

TRENDnet TV-IP1314PI 安全漏洞

The TRENDnet TV-IP1314PI is a wireless network camera from TRENDnet. The TRENDnet TV-IP1314PI suffers from a command injection vulnerability, which originates from davinci's use of the system function to unpack language packets without strict filtering of URL strings, which can be exploited by an...

The vulnerability of the Flask-Security-Too security management tool lies in the redirection of URLs to an unreliable website, allowing attackers to redirect users to arbitrary URL addresses.

The vulnerability of the Flask-Security-Too security management tool is related to the redirection of URLs to an unreliable website when the “next” request parameter is processed. Exploiting this vulnerability allows a malicious actor to redirect users to any desired URL address remotely...

The vulnerability of the microprogrammed software of the Trio Q, Trio E, and Trio J Ethernet receivers lies in their ability to be redirected to untrusted URL addresses. This allows attackers to redirect users to arbitrary websites.

The vulnerability of the microprogrammed Ethernet receiver software from the Trio Q, Trio E, and Trio J series is related to the ability to redirect users to untrusted URL addresses. Exploiting this vulnerability allows a malicious actor to redirect users to arbitrary websites by sending speciall...

UBUNTU-CVE-2023-6194

In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition DTD references to external entities. This means that if a user chooses to use a malicious report definition XML file containing an external entity reference to...

Catalis CMS360 Security Breach

Catalis CMS360 is a content management system from Catalis, Inc. A security vulnerability exists in Catalis CMS360. An attacker could exploit the vulnerability to view sensitive files by modifying document and other identifiers in URLs...

CVE-2023-45482

Tenda AC10 version USAC10V4.0siV16.03.10.13cn was discovered to contain a stack overflow via the urls parameter in the function getparentControllistInfo...

Mozilla: Incorrect parsing of relative URLs starting with "///"

The Mozilla Foundation Security Advisory describes this flaw as: Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override the specified host. This could contribute to security problems in web sites...

The vulnerability of the Adblock-lists component in the Brave Browser allows a hacker to redirect users to any desired URL address.

The vulnerability of the Adblock-lists component in the Brave Browser involves redirecting URLs to unreliable websites. Exploiting this vulnerability could allow a malicious actor to redirect users to arbitrary URL addresses...

Mozilla: WebExtensions could open arbitrary URLs

The Mozilla Foundation Security Advisory describes this flaw as: A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data...

Mozilla: WebExtensions could open arbitrary URLs

The Mozilla Foundation Security Advisory describes this flaw as: A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data...