RHEL 8 : firefox (RHSA-2022:0816)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:0816 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

Keyboard layout dynamic sync not working with East Asian, Cyrillic language usernames

When a user using Windows English OS and the username chars are East Asian/Cyrillic Unicode, the Keyboard layout dynamic sync of the Citrix Workspace App will not work. The remote language bar’s language will always be the first-time synced language when the session is created. Changing Microsoft...

Amazon Linux 2 : expat (ALAS-2022-1764)

The version of expat installed on the remote host is prior to 2.1.0-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1764 advisory. A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML...

Integer Overflow or Wraparound

Description The microweber application allows large characters to insert in the input field like "Town, ZIP, State, Address, and Additional Info field" which can allow attackers to cause a Denial of Service DoS via a crafted HTTP request. Proof of Concept 1.Buy a product and in the Shipping metho...

chantdemonpays.qc.ca Cross Site Scripting vulnerability OBB-2418740

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

openSUSE 15 Security Update : expat (openSUSE-SU-2022:0713-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0713-1 advisory. - xmltokimpl.c in Expat aka libexpat before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is val...

OPENSUSE-SU-2022:0713-1 Security update for expat

This update for expat fixes the following issues: - CVE-2022-25236: Fixed possible namespace-separator characters insertion into namespace URIs bsc1196025. - CVE-2022-25235: Fixed UTF-8 character validation in a certain context bsc1196026. - CVE-2022-25313: Fixed stack exhaustion in buildmodel vi...

WordPress 15Zine cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions prior to Wordpress 15Zine 3.3.0, which ste...

CVE-2022-24723

URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse ca...

Car Driving School Management System SQL Injection Vulnerability

A SQL injection vulnerability exists in Car Driving School Management System, a driving school management system, which stems from the fact that the product login page does not effectively filter special characters in user input data, and can be exploited to execute malicious An attacker can...

CodeIgniter 输入验证错误漏洞

CodeIgniter is an open source web framework written in PHP. An input validation error vulnerability exists in CodeIgniter because the product does not effectively filter special characters in HTTP requests. The following products and versions are affected: versions prior to 4.1.9...

GitLab Enterprise Edition 和 GitLab Community Edition 访问控制错误漏洞

GitLab Enterprise Edition is a content management system, and GitLab Community Edition is a community edition of GitLab from GitLab, Inc. An Access Control Error vulnerability exists in GitLab Enterprise Edition and GitLab Community Edition that stems from inaccurately displaying Snippet files th...

HMS SQL Injection Vulnerability (CNVD-2022-71116)

HMS is a computer or web-based hospital management system in Bangladesh. Useful for managing the operations of a hospital or any medical facility, a SQL injection vulnerability exists in HMS v1.0, which stems from the fact that the product admin.php page does not do effective filtering of special...

Protocol/Hostname spoofing via Improper Input Validation

Description The uri.js doesn't remove whitespace characters from the beginning of the protocol, so it doesn't parse URLs properly. Several methods, including http.get, location.href, and fetch, strip the whitespace character in front of the protocol before sending the request. Proof of Concept...

Code injection

In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO Right-to-Left Override characters was possible...

CVE-2022-24346

In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO Right-to-Left Override characters was possible...

CVE-2022-24346

The CVE-2022-24346 issue affects JetBrains IntelliJ IDEA prior to 2021.3.1, where local code execution could be triggered via Right-to-Left Override (RLO) characters embedded in a project/file. Red Hat and NVD entries confirm the same description. Impact is defined as local code execution with pa...

Wordpress Database Backup Plugin SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is a WordPress open source application plugin. wordpress Database Backup Plugin has a SQL injecti...

url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.

Leading control characters in a URL are not stripped when passed into url-parse. This can cause input URLs to be mistakenly be interpreted as a relative URL without a hostname and protocol, while the WHATWG URL parser will trim control characters and treat it as an absolute URL. If url-parse is...

GHSA-JF5R-8HM2-F872 url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.

Leading control characters in a URL are not stripped when passed into url-parse. This can cause input URLs to be mistakenly be interpreted as a relative URL without a hostname and protocol, while the WHATWG URL parser will trim control characters and treat it as an absolute URL. If url-parse is...