Craft fair vendors targeted by fake event scammers on Facebook

A real world scam which sucks the fun out of craft fairs has caused nothing but stress for victims. It may sound bizarre, but it’s actually a fairly popular attack focused on small/self-run business owners selling their own creations. Are you ready for a trip to the craft fair? You’re a small...

CVE-2021-44491

An issue was discovered in YottaDB through r1.32 and V7.0-000. Using crafted input, attackers can cause a calculation of the size of calls to memset in opfnj3 in srport/opfnj3.c to result in an extremely large value in order to cause a segmentation fault and crash the application. This is a digs-...

CVE-2022-27139

An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is only possible by trusted authenticated users. The uploadin...

GHSA-WF98-VXV9-JQFV XSS Injection Vulnerability

Impact Under some circumstances, the Feeds widget on the dashboard could have an XSS vulnerability if a malformed feed was supplied. Patches This has been patched in Craft 3.7.29. References https://github.com/craftcms/cms/blob/develop/CHANGELOG.md3729---2022-01-18 For more information If you hav...

XSS Injection Vulnerability

Impact Under some circumstances, the Feeds widget on the dashboard could have an XSS vulnerability if a malformed feed was supplied. Patches This has been patched in Craft 3.7.29. References https://github.com/craftcms/cms/blob/develop/CHANGELOG.md3729---2022-01-18 For more information If you hav...

GHSA-7XJ5-FWQR-5378 Cross-site Scripting in craftcms/cms

Craft CMS before 3.7.29 allows cross-site scripting...

Cross-site Scripting in craftcms/cms

Craft CMS before 3.7.29 allows cross-site scripting...

CVE-2022-28378

Craft CMS before 3.7.29 allows XSS...

CVE-2022-28378

Craft CMS before 3.7.29 allows XSS...

Cross site scripting

Craft CMS before 3.7.29 allows XSS...

CVE-2022-28378

Craft CMS before 3.7.29 allows XSS...

CVE-2022-28378

Craft CMS before 3.7.29 allows XSS...

CVE-2022-28378

Craft CMS vulnerability (CVE-2022-28378) : The XSS flaw affects Craft CMS versions before 3.7.29. Public sources attribute the issue to the FeedWidget.js input handling, where unfiltered links enable script injection. Impact is cross-site scripting with user interaction sometimes required dependi...

Pixel＆tonic Craft CMS 跨站脚本漏洞

Pixel & tonic Craft CMS is a content management system CMS from Pixel & Tonic Pixel & tonic USA. A security vulnerability exists in Craft CMS versions prior to 3.7.29 that allows an attacker to execute cross-site scripting...

Craft CMS Cross-site Scripting Vulnerability

Craft CMS before 3.6.13 has an XSS vulnerability...

GHSA-H2RJ-8WGG-MM43 Craft CMS Cross-site Scripting Vulnerability

Craft CMS before 3.6.13 has an XSS vulnerability...

thunderbird: Crafted email could trigger an out-of-bounds write

A flaw was found in Thunderbird. The vulnerability occurs due to an out-of-bounds write of one byte when processing the message. This flaw allows an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write...

CVE-2021-42951

A Remote Code Execution RCE vulnerability exists in Algorithmia MSOL all versions before October 10 2021 of SaaS. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to create a new, specially crafted Algorithm...

Authentication flaw

Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process starts, allowing attackers with access to Jenkins to craft a URL that will redirect users to an attacker-specified URL after logging in...

CVE-2022-25196

Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process starts, allowing attackers with access to Jenkins to craft a URL that will redirect users to an attacker-specified URL after logging in...