GHSA-M53P-F25Q-Q6FG XXE vulnerability in Jenkins Robot Framework Plugin

Robot Framework Plugin 2.0.0 and earlier does not configure the XML parser to prevent XML external entity XXE attacks. This allows a user able to control the input files for the 'Publish Robot Framework' post-build step to have Jenkins parse a crafted file that uses external entities for extracti...

CVE-2022-1810

Authorization Bypass Through User-Controlled Key in GitHub repository publify/publify prior to 9.2.9...

CVE-2022-1810

Authorization Bypass Through User-Controlled Key in GitHub repository publify/publify prior to 9.2.9...

CVE-2022-1810

CVE-2022-1810 affects Publify/publify before 9.2.9, where an authorization bypass is possible through a user-controlled key. The issue concerns access control of admin content, enabling a low-privilege user to modify/delete administrator posts. Affected product: Publify web publishing software. R...

CVE-2022-1810 Authorization Bypass Through User-Controlled Key in publify/publify

Authorization Bypass Through User-Controlled Key in GitHub repository publify/publify prior to 9.2.9...

Potential Cross-site Scripting vulnerability in Hydrogen

Impact There is a potential Cross-Site Scripting XSS vulnerability where an arbitrary user is able to execute scripts on pages that are built with Hydrogen. This affects all versions of Hydrogen starting from version 0.10.0 to 0.18.0. This vulnerability is exploitable in applications whose...

CVE-2022-30992

Open redirect via user-controlled query parameter. The following products are affected: Acronis Cyber Protect 15 Linux, Windows before build 29240...

CVE-2022-30992

Open redirect via user-controlled query parameter. The following products are affected: Acronis Cyber Protect 15 Linux, Windows before build 29240...

Open redirect

Open redirect via user-controlled query parameter. The following products are affected: Acronis Cyber Protect 15 Linux, Windows before build 29240...

CVE-2022-30992 Open redirect via user-controlled query parameter

Open redirect via user-controlled query parameter. The following products are affected: Acronis Cyber Protect 15 Linux, Windows before build 29240...

CVE-2022-30992

CVE-2022-30992 affects Acronis Cyber Protect 15 (Linux/Windows) before build 29240, with an input validation/open redirect vulnerability via a user-controlled query parameter. Root cause cited as input validation error; impact is open redirect. Connected sources (CNVD/CNNVD/NVD) confirm the affec...

CVE-2022-1362

The affected On-Premise cnMaestro is vulnerable inside a specific route where a user can upload a crafted package to the system. An attacker could abuse this user-controlled data to execute arbitrary commands on the server...

EC-CUBE vulnerable to authorization bypass

Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' information by sending a crafted HTTP request...

Cross-site Scripting in Jenkins

A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled HTML by Jenkins...

Cisco RoomOS Software and Cisco TelePresence Collaboration Endpoint Software Redirection Vulnerability

Cisco RoomOS Software and Cisco TelePresence Collaboration Endpoint Software are both products of Cisco, a U.S. company.Cisco RoomOS Software is a set of automated management software for Cisco devices. Cisco TelePresence Collaboration Endpoint Software is a set of collaboration endpoint...

CVE-2022-20794

Multiple vulnerabilities in the web engine of Cisco TelePresence Collaboration Endpoint CE Software and Cisco RoomOS Software could allow a remote attacker to cause a denial of service DoS condition, view sensitive data on an affected device, or redirect users to an attacker-controlled destinatio...

CVE-2021-4207

A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values cursor-header.width and cursor-header.height can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use...

CVE-2021-4207

A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values cursor-header.width and cursor-header.height can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use...

CVE-2021-4207

A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values cursor-header.width and cursor-header.height can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use...

UBUNTU-CVE-2022-1441

MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file, it calls the function diSTboxread to read from video. In this function, it allocates a buffer str with fixed length. However, content read from bs is controllable ...