GHSA-Q4Q5-C5CV-2P68 Vuetify Cross-site Scripting vulnerability

The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting XSS due to improper input sanitization in the 'eventName' function within the VCalendar component...

CVE-2021-4178

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML...

CVE-2021-4178

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML...

Mealie 代码问题漏洞

Mealie is a self-hosted recipe manager and meal planner from an individual developer in Hayden, USA. A security vulnerability exists in Mealie version 1.0.0beta3, which stems from the fact that it does not terminate download tokens after a user logs out leading to an attacker being able to perfor...

CVE-2022-25228

CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in '/index.php?m=settings&a=show' via the 'userID' parameter, in '/index.php?m=candidates&a=show' via the 'candidateID', in '/index.php?m=joborders&a=show' via the 'jobOrderID' and '/index.php?m=companies&a=show' via...

CandidATS SQL注入漏洞

CandidATS is a free and open source recruiter tracking system from CandidATS India. A security vulnerability exists in CandidATS version 3.0.0 Beta that stems from allowing authenticated users to inject SQL queries via the userID parameter...

PT-2022-17167 · Candidats · Candidats

Name of the Vulnerable Software and Affected Versions: CandidATS version 3.0.0 Beta Description: The issue allows an authenticated user to inject SQL queries through specific API endpoints, including '/index.php?m=settings&a=show' via the userID parameter, '/index.php?m=candidates&a=show' via the...

CVE-2022-34618

A stored cross-site scripting XSS vulnerability in Mealie 1.0.0beta3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the recipe description text field...

PT-2022-20594 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse affected versions not specified Description: Discourse is an open source discussion platform. In affected versions, an email activation route can be abused to send mass spam emails. A fix has been included in the latest stable, beta...

Important: Red Hat Security Advisory: container-tools:rhel8 security and bug fix update

An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

kubernetes-client: Insecure deserialization in unmarshalYaml method

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML...

CVE-2022-2290

Cross-site Scripting XSS - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta...

CVE-2022-2290

Cross-site Scripting XSS - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta...

ERPNext 跨站脚本漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. A cross-site scripting vulnerability exists in ERPNext versions v13.0.0-beta.13 through v13.30.0, which can be exploited by an attacker to conduct an account takeover attack with a low-privileged user...

CVE-2022-23056: Improper Neutralization of Input During Web Page Generation

In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an account takeover attack...

Malicious code in @tekion/beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25635e252b9808c78842badaf5878dca711e8678777c82f2327a3561c58a7d7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-627 Malicious code in @tekion/beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25635e252b9808c78842badaf5878dca711e8678777c82f2327a3561c58a7d7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4870 Malicious code in noblox.js-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 332a81ed84651ca22b9a949cc938519334d55fc1b9a8fce6a5b123de2098ef96 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in noblox.js-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 332a81ed84651ca22b9a949cc938519334d55fc1b9a8fce6a5b123de2098ef96 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discord.js-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41ff73fb3183f69a72984a800fd1acb09d2a242b539d96f17ef1b398885cf1c5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...