WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL. H5P CSS Editor plugin is a WordPress open source application plugin. WordPress H5P CSS Editor plugin has a...

AbanteCart 跨站脚本漏洞

AbanteCart is a PHP-based e-commerce platform. AbanteCart is vulnerable to a cross-site scripting vulnerability prior to 1.3.2, which stems from a lack of data validation filtering of user-supplied data and output. An attacker with file upload privileges could exploit this vulnerability to upload...

Tencent WeChat WXAM Decoder Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Tencent WeChat. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the WXAM...

FreeBSD : chromium -- multiple vulnerabilities (fb9ba490-5cc4-11ec-aac7-3065ec8fd3ec)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the fb9ba490-5cc4-11ec-aac7-3065ec8fd3ec advisory. - Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to...

Function sync in ChainlinkOracle.sol does not check the price returned from chainlink aggregators

Handle ye0lde Vulnerability details Impact The sync function in the contract ChainlinkOracle.sol fetches the feedPrice' from a Chainlink aggregator using the latestRoundDatafunction. There are checks on thetimeStampversus previous versions of the feed protecting against stale prices. But there is...

Adobe Experience Manager 跨站脚本漏洞

Adobe Experience Manager AEM is a content management solution from Adobe that can be used to build websites, mobile applications and forms. The solution supports mobile content management, marketing and sales campaign management, and multi-site management, etc. A cross-site scripting vulnerabilit...

Adobe Experience Manager 跨站脚本漏洞

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

Microsoft Edge (Chromium) < 96.0.1054.57 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 96.0.1054.57. It is, therefore, affected by multiple vulnerabilities as referenced in the December 14, 2021 advisory. - Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to...

Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2021:1582-1 Rating: important References: 1192310 1192734 1193519 Cross-References: CVE-2021-38005 CVE-2021-38006 CVE-2021-38007 CVE-2021-38008 CVE-2021-38009 CVE-2021-38010 CVE-2021-38011 CVE-2021-38012...

The vulnerability of the HarmonyOS operating system’s kernel arises from insufficient validation of input data, allowing attackers to trigger service failures.

The vulnerability of the HarmonyOS operating system exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...

The vulnerability of the HarmonyOS operating system’s kernel arises from insufficient validation of input data, allowing attackers to trigger service failures.

The vulnerability of the HarmonyOS operating system exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...

chromium -- multiple vulnerabilities

Chrome Releases reports: This release contains 5 security fixes, including: 1263457 Critical CVE-2021-4098: Insufficient data validation in Mojo. Reported by Sergei Glazunov of Google Project Zero on 2021-10-26 1270658 High CVE-2021-4099: Use after free in Swiftshader. Reported by Aki Helin of...

Insecure Authentication

qt5-qtwebengine has insecure authentication. An insufficient data validation security issue has been found in the loader component of the Chromium browser engine...

Belloo Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in versions of Belloo prior to 4.2.7.7, which allows attackers to filter user-supplied data and output data via the aerror description parameter in the assets/sources/instagram.php script. description parameter in the assets/sources/instagram.php script...

ZZZCMS Cross-Site Scripting Vulnerability

ZZZCMS is a content management system CMS from the ZZZCMS team in China. ZZZCMS suffers from a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied and output data in the editfile action of /adminxxx/save.php. An attacker could exploit the...

74 CMS Cross-Site Scripting Vulnerability (CNVD-2021-99667)

74cms is a PHP and MySQL-based online recruitment system from China Xunyi Technology Co. 74CMS has a cross-site scripting vulnerability in version v6.0.4, which originates from /index.php?m=&c=help&a=helplist&key missing a data validation filter for user-supplied data and output. An attacker coul...

DouPHP Cross-Site Scripting Vulnerability (CNVD-2022-03909)

DouPHP is a lightweight enterprise content management system CMS from China DouShell Network Technology, Inc. A cross-site scripting vulnerability exists in DouPHP, which stems from a lack of data validation filtering of user-supplied and output data in /admin/cloud.php. An attacker could exploit...

KNIME Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in Knime, the Swiss company's enterprise software for putting data science workflows into production. knime stems from the lack of proper validation of client-side data by the WEB application, which can be exploited by attackers to execute client-side...

Gryphon Tower Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in Gryphon Tower, a wireless router from Gryphon. The vulnerability stems from a lack of user-supplied data and output data validation filtering in the url parameter of cgi-bin/luci/siteaccess/, which can be exploited to execute client-side JavaScript...

Chromium: CVE-2021-4059 Insufficient data validation in loader

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...