13353 matches found
GHSA-PV7V-PH6G-3GXV Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml
Impact The HTML sanitizer, introduced in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid data attributes. This can be exploited, e.g., via the link syntax in any content that supports XWiki syntax like comments in XWiki:...
DEBIAN-CVE-2023-31490
An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgpattrpsidsub function...
AZL-26729 CVE-2023-31490 affecting package frr for versions less than 8.5.1-2
An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgpattrpsidsub function...
CVE-2023-31490
An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgpattrpsidsub function...
kernel: net/sched: sch_taprio: fix possible use-after-free
In the Linux kernel, the following vulnerability has been resolved: net/sched: schtaprio: fix possible use-after-free syzbot reported a nasty crash 1 in nettxaction which made little sense until we got a repro. This repro installs a taprio qdisc, but providing an invalid TCARATE attribute...
kernel: ext4: fix deadlock due to mbcache entry corruption
A deadlock vulnerability was found in the ext4 filesystem in the Linux kernel. When manipulating extended attribute xattr blocks, a race condition in non-atomic bitfield updates can cause the mbcache entry state to become corrupted. This leads to an infinite loop in ext4xattrblockset where the co...
PT-2025-13367
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the fixed version Description A use-after-free issue has been identified in the Linux kernel, specifically in the sch taprio component. This issue occurs when a taprio qdisc is installed with an invalid TCA RATE...
CVE-2023-0526
The Post Shortcode WordPress plugin through 2.0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2023-0537 Product Slider For WooCommerce Lite <= 1.1.7 - Contributor+ Stored XSS
The Product Slider For WooCommerce Lite WordPress plugin through 1.1.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...
WordPress plugin Video List Manager has a SQL injection vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
WordPress Plugin: Ultimate Carousel for WPBakery Page Builder – Cross-site Script Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...
WordPress plugin WP Inventory Manager has a cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
WordPress plugin WP Login Box has a cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
PT-2023-17329 · WordPress · Wp Popups
Name of the Vulnerable Software and Affected Versions: WP Popups WordPress plugin versions prior to 2.1.5.1 Description: The issue arises from insufficient escaping of the href attribute in the spu-facebook-page shortcode, potentially allowing Stored Cross-Site Scripting attacks by users with the...
Improper Neutralization of Special Elements Used in a Template Engine
Overview std/html/template is a Go standard library package std/html/template Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine. Go Vulnerability Report:Templates containing actions in unquoted HTML attributes e.g. "attr=."...
SLP Find Attributes
The remote server understands Service Location Protocol SLP, a protocol that allows network applications to discover the existence, location, and configuration of various services in an enterprise network environment. Services listed via SLP may include a number of attributes. These attributes ar...
Shannon Baseband fmtp SDP Attribute Memory Corruption
Shannon Baseband: Memory corruption when processing fmtp SDP attribute There is a memory corruption vulnerability that occurs when the baseband modem processes SDP when setting up a call. When an fmtp attribute is parsed, the integer that represents the payload type is copied into an 8-byte buffe...
rubygem-loofah: inefficient regular expression leading to denial of service
An inefficient regular expression vulnerability was found in rubygem loofah. While sanitizing certain SVG attributes, loofah is susceptible to excessive backtracking, which can result in a denial of service through CPU resource consumption...
PT-2023-6577 · WordPress · Custom 404 Pro
Name of the Vulnerable Software and Affected Versions: Custom 404 Pro versions prior to 3.7.3 Description: The issue is related to the Custom 404 Pro WordPress plugin, which does not properly escape some URLs before outputting them in attributes. This can lead to Reflected Cross-Site Scripting,...
