CVE-2023-0044

CVE-2023-0044 concerns Quarkus Form Authentication: if the session cookie Path is set to “/”, a cross-site attack may disclose information. The issue is described across multiple sources tied to Quarkus advisories (Red Hat RHSA entries and IBM/OSV records) and is mitigated by the Quarkus CSRF Pre...

CVE-2023-0044

If the Quarkus Form Authentication session cookie Path attribute is set to / then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature...

K10506844: Apache Struts 2 vulnerabilities CVE-2013-1966, CVE-2013-2115, CVE-2013-2134, and CVE-2013-2135

Security Advisory Description CVE-2013-1966 Apache Struts 2 before 2.3.14.1 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the 1 URL or 2 A tag. CVE-2013-2115 Apache Struts 2 before 2.3.14.2 allow...

K34250741: BIND vulnerability CVE-2015-8000

Security Advisory Description db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service REQUIRE assertion failure and daemon exit via a malformed class attribute. CVE-2015-8000 Impact An attack may cause a denial-of-service DoS ...

CVE-2022-4714

The WP Dark Mode WordPress plugin before 4.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack...

CVE-2022-4791

The Product Slider and Carousel with Category for WooCommerce WordPress plugin before 2.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack...

CVE-2020-36656

The Spectra WordPress plugin before 1.15.0 does not sanitize user input as it reaches its style HTML attribute, allowing contributors to conduct stored XSS attacks via the plugin's Gutenberg blocks...

Cross site scripting

The Spectra WordPress plugin before 1.15.0 does not sanitize user input as it reaches its style HTML attribute, allowing contributors to conduct stored XSS attacks via the plugin's Gutenberg blocks...

Cross site scripting

The WP Responsive Testimonials Slider And Widget WordPress plugin through 1.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored...

PT-2023-15185 · WordPress · Wp Dark Mode

Name of the Vulnerable Software and Affected Versions: WP Dark Mode WordPress plugin versions prior to 4.0.0 Description: The issue concerns a lack of validation and escaping of one of the shortcode attributes in the WP Dark Mode WordPress plugin. This could allow users with a role as low as...

PT-2023-1533 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel version 6.0.8 Description: The issue is related to an out-of-bounds read in the ntfs attr find function in fs/ntfs/attrib.c. This can potentially allow an attacker to cause a denial of service. Recommendations: For Linux kernel...

PT-2025-54151

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's ext4 filesystem implementation. Specifically, the issue involves handling extended attribute ea block expansion during unmounting. The process require...

SQL Injection

sequelize is vulnerable to SQL Injection attacks. A specifically crafted attack statement through query-generator.js allows a malicious user to inject and execute arbitrary SQL queries on the target system due to improper attribute filtering...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox that originates from allowing arbitrary memory writes via the PKCS 12 Safe Bag attribute...

UBUNTU-CVE-2020-6817

bleach.clean behavior parsing style attributes could result in a regular expression denial of service ReDoS. Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean..., attributes='a': 'style'...

CVE-2023-22578

Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections...

Sql injection

Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections...

CVE-2023-22578

CVE-2023-22578 affects the Sequelize JavaScript ORM. The issue is caused by improper attribute filtering, enabling a remote attacker to execute SQL injections via crafted queries that can view, add, modify, or delete data in the back-end database. Documented impacts in the IBM/Red Hat/OSS advisor...

CVE-2023-22578 Sequalize - Default support for “raw attributes” when using parentheses

Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections...

PT-2023-18562 · Sequelize · Sequelize

Name of the Vulnerable Software and Affected Versions: Sequelize versions prior to 6.29.0 Sequelize versions prior to 7.0.0.alpha-20 Description: The issue is due to improper attribute filtering in the Sequelize JS library, allowing an attacker to perform SQL injections. This can be exploited whe...