PT-2023-5802 · Acronis · Acronis Cyber Protect Home Office

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect Home Office versions before build 40278 Description: The issue is related to improper soft link handling, which can lead to local privilege escalation during installation. This allows an attacker to elevate their...

Splunk 代码问题漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze data and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

CVE-2023-39678

A cross-site scripting XSS vulnerability in the device web interface Log Query page of BDCOM OLT P3310D-2AC 10.1.0F Build 69083 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter...

CVE-2023-39678

A cross-site scripting XSS vulnerability in the device web interface Log Query page of BDCOM OLT P3310D-2AC 10.1.0F Build 69083 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter...

CVE-2023-39678

The CVE-2023-39678 entry describes an XSS flaw in the web interface (Log Query page) of the BDCOM OLT P3310D-2AC, firmware 10.1.0F Build 69083. Vulnerable component: the Log Query username parameter; root cause is reflected/stored XSS allowing arbitrary web script/HTML execution. Impact explicitl...

QNAP QuTS hero Multiple Vulnerabilities (QSA-23-58, QSA-23-59)

QNAP QuTS hero is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qutshero"; ifdescriptio...

BDCOM OLT P3310D-2AC 跨站脚本漏洞

The BDCOM OLT P3310D-2AC is a dual power optical path terminal from BDCOM China. A security vulnerability exists in BDCOM OLT P3310D-2AC version 10.1.0F Build 69083. An attacker can exploit this vulnerability to execute arbitrary web script or HTML via a specially crafted payload injected with th...

CVE-2023-41249

In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step...

CVE-2023-41249

In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step...

Cross site scripting

In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step...

CVE-2023-41249

In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step...

CVE-2023-41249

In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step...

JetBrains TeamCity 跨站脚本漏洞

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides features such as continuous unit testing, code quality analysis and build issue analysis reports. A cross-site scripting vulnerability exists in JetBrai...

PT-2023-27868 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2023.05.3 Description: The issue allows for reflected XSS during the copying of Build Step. Recommendations: For versions prior to 2023.05.3, update to version 2023.05.3 or later to resolve the issue...

CVE-2023-40030

Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject nearly arbitrar...

CVE-2023-40030

Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject nearly arbitrar...

AZL-28511 CVE-2023-40030 affecting package rust for versions less than 1.72.0-2

Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject nearly arbitrar...

CVE-2023-40030

Summary (CVE-2023-40030): Cargo could include unescaped Cargo feature names in the timings report, enabling potential cross-site scripting if the report is uploaded to a site that uses credentials. This affects builds using dependencies from git/local paths/alternative registries; crates.io-only ...

GHSA-WRRJ-H57R-VX9P Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports

The Rust Security Response WG was notified that Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject nearly arbitrary HTML here, potentially leading to XSS if the report is subsequent...

Remote Code Execution (RCE)

org.jenkins-ci.plugins: convert-to-pipeline is vulnerable to Remote Code Execution RCE. The vulnerability exists due to improperly converting the build environment, build steps, and post-build actions of freestyle projects to the corresponding pipeline step invocations via simple string...