CVE-2022-29446

Authenticated administrator or higher role Local File Inclusion LFI vulnerability in Wow-Company's Counter Box plugin = 1.1.1 at WordPress...

WordPress plugin Visual Slide Box Builder SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Visual Slide Box Builder plugin 3.2.9 and earlier versions are vulnerable to SQL injection, which...

WordPress Counter Box plugin <= 1.1.1 - Authenticated Local File Inclusion (LFI) vulnerability

Authenticated Local File Inclusion LFI vulnerability discovered by 0xB9 Patchstack Alliance in WordPress Counter Box plugin versions = 1.1.1. Solution Update the WordPress Counter Box plugin to the latest available version at least 1.2...

Counter Box < 1.2 - Admin+ LFI

The plugin does not properly validate the current tab used before generating a path and using it in an include statement, which could lead to LFI...

GHSA-QWV2-2X8G-G43G Gem in a Box vulnerable to Cross-site Request Forgery

geminabox aka Gem in a Box before 0.13.7 has CSRF, as demonstrated by an unintended gem upload...

Gem in a Box vulnerable to Cross-site Request Forgery

geminabox aka Gem in a Box before 0.13.7 has CSRF, as demonstrated by an unintended gem upload...

GHSA-98HQ-3QVG-PG78 Gem in a Box vulnerable to Cross-site Scripting

geminabox aka Gem in a Box before 0.13.6 is vulnerable to Cross-site Scripting XSS, as demonstrated by uploading a gem file that has a crafted gem.homepage value in its .gemspec file...

Gem in a Box vulnerable to Cross-site Request Forgery

geminabox aka Gem in a Box before 0.13.7 has CSRF, as demonstrated by an unintended gem upload...

WordPress IMDB Info Box plugin <= 2.0 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Fayçal CHENA in WordPress IMDB Info Box plugin versions = 2.0. Solution Deactivate and delete. This plugin has been closed as of April 11, 2022 and is not available for download. This closure is temporary, pending a full review...

IMDB info box <= 2.0 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitize and escape some of its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed As administrator, put the following payload in any of the plugin's settings and save: "alert/XSS/;...

GPAC 代码问题漏洞

GPAC is an open source multimedia framework. A code issue vulnerability exists in GPAC version 2.1-DEV-rev87-g053aae8-master, which stems from a null pointer dereference vulnerability due to improper handling of the return value of GFSKIPBOX in the application gfisomparsemovieboxesinternal. An...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : jasper (SUSE-SU-2022:1479-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1479-1 advisory. - CVE-2021-3467: Fixed NULL pointer deref in jp2decode bsc1184757. - CVE-2021-3443: Fixed NULL...

DEBIAN-CVE-2022-1441

MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file, it calls the function diSTboxread to read from video. In this function, it allocates a buffer str with fixed length. However, content read from bs is controllable ...

UBUNTU-CVE-2022-1441

MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file, it calls the function diSTboxread to read from video. In this function, it allocates a buffer str with fixed length. However, content read from bs is controllable ...

PT-2022-13892 · Gpac · Gpac

Name of the Vulnerable Software and Affected Versions: GPAC versions 2.0.0 Description: The issue arises when MP4Box, a component of GPAC, attempts to parse a MP4 file. It calls the function diST box read to read from the video, allocating a buffer str with a fixed length. However, the content re...

WordPress Visual Slide Box Builder plugin <= 3.2.9 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by p7e4 in WordPress Visual Slide Box Builder plugin versions = 3.2.9. Solution Deactivate and delete. This plugin has been closed as of March 30, 2022 and is not available for download. This closure is temporary, pending a full review...

CVE-2021-21938

A heap-based buffer overflow vulnerability exists in the Palette box parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability...

Heap overflow

A heap-based buffer overflow vulnerability exists in the Palette box parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2021-21938

A heap-based buffer overflow vulnerability exists in the Palette box parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability...

PT-2022-9203 · Accusoft · Accusoft Imagegear

Name of the Vulnerable Software and Affected Versions: Accusoft ImageGear version 19.10 Description: A heap-based buffer overflow vulnerability exists in the Palette box parser functionality. This can be triggered by a specially-crafted file, potentially leading to code execution. An attacker can...