PekeUpload 跨站脚本漏洞

PekeUpload is a Jquery Html5 file upload plugin from the personal developer Pedro Molina in Colombia. pekeUpload suffers from a cross-site scripting vulnerability that exists due to insufficient cleanup of user-supplied data. A remote attacker could exploit the vulnerability to be able to trick a...

Apache Superset up和Apache Superset 跨站脚本漏洞

A cross-site scripting vulnerability exists in Apache Superset, a data visualization and data exploration platform from the Apache Foundation, U.S. The vulnerability stems from insufficient cleanup of user-supplied data on browser pages. An attacker could exploit the vulnerability to trick victim...

The vulnerability of the Magento Commerce software platform for developing and managing online stores stems from the lack of measures taken at the management level to clean up data. This allows attackers to execute arbitrary code.

The vulnerability of the Magento Commerce software platform for developing and managing online stores is related to the lack of measures taken to clean up data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Brackets text editor, related to the lack of measures taken at the control level to clean up data, allows attackers to execute arbitrary commands.

The vulnerability of the Brackets text editor is related to the lack of measures taken at the control level to clean up data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on the target system remotely...

The vulnerability of the Magento Commerce software platform for developing and managing online stores stems from the lack of measures taken at the management level to clean up data. This allows attackers to execute arbitrary code.

The vulnerability of the Magento Commerce software platform for developing and managing online stores is related to the lack of measures taken to clean up data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Zabbix universal monitoring system, related to improper cleaning of user data in the “hostinventoriesoverview.php” script, allows a hacker to execute arbitrary SQL commands.

The vulnerability of the Zabbix universal monitoring system is related to improper cleaning of user data in the script “hostinventoriesoverview.php”. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands by sending specially crafted queries remotely...

The vulnerability of the Adobe Photoshop graphic editor lies in the lack of measures taken at the control level to clean up data, allowing a hacker to execute arbitrary code.

The vulnerability of the Adobe Photoshop graphic editor is related to the lack of measures taken at the control level to clean up data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

MISP 安全漏洞

MISP is an open source software solution. The product is used to collect, store, distribute, and share cybersecurity metrics, and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP version 2.4.144, which stems from the fact that...

Nextcloud: Webauthn tokens are not removed on user deletion

userA has an account on serverA 2. userA enables passwordless login webauthn and registers a key/device 3. userA is removed from the system 4. a new user comes along and gets assigned userA as id 5. the old userA tries to login with their key 6. the old userA can see all data of the new userA...

The vulnerability of the Cisco IOS XE operating system, related to the lack of measures taken to clean data at the management level, allows attackers to enhance their privileges and execute arbitrary code.

The vulnerability of the Cisco IOS XE operating system is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow a malicious actor to enhance their privileges and execute arbitrary code...

Vulnerability of the ssh_scp_new() function in the libssh library, allowing a hacker to execute arbitrary code

The vulnerability of the sshscpnew function in the libssh library is related to the lack of measures taken at the control level to clean up data. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Ansible: modules which use files encrypted with vault are not properly cleaned up

A flaw was found on Ansible Engine when using modules which decrypts vault files such as assemble, script, unarchive, wincopy, awss3 or copy modules. The temporary directory is created in /tmp leaves the secrets unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root...

CVE-2019-8730

The contents of locked notes sometimes appeared in search results. This issue was addressed with improved data cleanup. This issue is fixed in macOS Catalina 10.15. A local user may be able to view a user’s locked notes...

Design/Logic Flaw

The contents of locked notes sometimes appeared in search results. This issue was addressed with improved data cleanup. This issue is fixed in macOS Catalina 10.15. A local user may be able to view a user’s locked notes...

CVE-2019-8730

The contents of locked notes sometimes appeared in search results. This issue was addressed with improved data cleanup. This issue is fixed in macOS Catalina 10.15. A local user may be able to view a user’s locked notes...

CVE-2019-8730

CVE-2019-8730 affects macOS Notes on macOS Catalina. The issue allowed a local attacker to view a user’s locked notes because contents could appear in search results. Apple fixed the issue as part of Catalina 10.15 via improved data cleanup. Public references confirm the vulnerability description...

CVE-2019-12902

Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion. This allows a new user, holding the same User ID as a deleted user, to restore the deleted user's data...

The vulnerability of the “/web/google_analytics.php” microprogramming software of Western Digital MyCloud NAS allows a intruder to execute arbitrary commands.

The vulnerability of the “/web/googleanalytics.php” microprogramming software of Western Digital MyCloud NAS is related to the lack of measures taken at the management level to clean up data. Exploiting this vulnerability allows a malicious actor to inject arbitrary commands using a specially...

Activity Stream Gadget causing high memory/CPU consumption

+Problem Definition+ Activity Stream Gadget causing high memory/CPU consumption when there is 1 million+ of records in the AO563AEEACTIVITYENTITY table. In this particular case, found that majority of these records are from 3rd party plugins Insight. However, do note that this can happen to any...

CVE-2008-5810

WBPublish aka WBPublish.exe in Fujitsu-Siemens WebTransactions 7.0, 7.1, and possibly other versions allows remote attackers to execute arbitrary commands via shell metacharacters in input that is sent through HTTP and improperly used during temporary session data cleanup, possibly related to 1...