13362 matches found
UBUNTU-CVE-2022-23476
Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri 1.13.8 and 1.13.9 fail to check the return value from xmlTextReaderExpand in the method Nokogiri::XML::Readerattributehash. This can lead to a null pointer exception when invalid markup is being parsed. Fo...
Nokogiri security vulnerabilities
Nokogiri is an open source software library for parsing HTML and XML in Ruby. A security vulnerability exists in Nokogiri versions 1.13.8 and 1.13.9, which stems from a null pointer exception when parsing invalid markup due to a failure to check the return value of xmlTextReaderExpand in its...
PT-2022-36380 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.225 Description: A use-after-free issue was found in the ntfs attr find function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to...
PT-2022-36124 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.80 Description: A use-after-free issue was found in the ntfs attr find function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to...
CVE-2022-41861
A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash...
Login with Cognito < 1.4.9 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Go to "Cognito Login » Configure OAuth", and a...
DSInternals Credential Roaming Elevation of Privilege Vulnerability
Impact A vulnerability exists in the DSInternals.Common.Data.RoamedCredential.Save method, which incorrectly parses the msPKIAccountCredentials LDAP attribute values. As a consequence, a malicious actor would be able to modify the file system of the computer where an application using this functi...
com.charlyghislain.keycloak:keycloak-importexport (>=11.0.1, <=11.0.2), com.manydesigns:demo-tt (>=5.2.0, <=5.2.1) +82 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (11.0.2)
org.keycloak:keycloak-core MAVEN version 11.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.charlyghislain.keycloak:keycloak-importexport =11.0.1, =5.2.0, =5.2.0, =1.1.0, =0.1.0, =0.0.3, =0.49,...
CVE-2022-3361
The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient input validation on the 'template' attribute used in shortcodes. This makes it possible for attackers with administrative privileges to supply arbitrary paths...
CVE-2022-3361: Improper Limitation of a Pathname to a Restricted Directory
The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient input validation on the 'template' attribute used in shortcodes. This makes it possible for attackers with administrative privileges to supply arbitrary paths...
PT-2022-21791 · WordPress · Ultimate Member
Name of the Vulnerable Software and Affected Versions: The Ultimate Member plugin for WordPress versions up to, and including 2.5.0 Description: The issue is related to directory traversal due to insufficient input validation on the template attribute used in shortcodes. This allows attackers wit...
Fedora: Security Advisory for drupal7-link (FEDORA-2022-d209710a36)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2022-37429
Silverstripe silverstripe/framework through 4.11 allows XSS issue 1 of 2 via JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters...
CVE-2022-37430
Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link issue 2 of 2...
Design/Logic Flaw
Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link issue 2 of 2...
CVE-2022-37429: Improper Neutralization of Input During Web Page Generation
Silverstripe silverstripe/framework through 4.11 allows XSS issue 1 of 2 via JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters...
CVE-2022-37429
Silverstripe silverstripe/framework through 4.11 allows XSS issue 1 of 2 via JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters...
CVE-2022-37429
Silverstripe silverstripe/framework through 4.11 allows XSS issue 1 of 2 via JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters...
Heimdal MIT Kerberos PAC DoS
The vulnerability of the PAC Privileged Attribute Certificate parameters in the krb5parsepac function of Heimdal and MIT Kerberos, as well as in Samba’s network interaction programs, is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to cause service...
