CVE-2022-2116

CVE-2022-2116 affects the WordPress plugin Elementor Contact Form DB prior to version 1.8.0. The root cause is insufficient sanitisation/escaping of certain parameters when echoed back in HTML attributes, leading to a Reflected Cross-Site Scripting vulnerability. The exposed impact is a client-si...

WordPress plugin Contact Form DB 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2022-4178 · Device42 · Device42 Cmdb

Name of the Vulnerable Software and Affected Versions: Device42 CMDB versions prior to 18.01.00 Description: The issue is related to improper access control in the Device42 Asset Management Appliance, specifically in the /Exago/WrImageResource.adx route. This allows an unauthenticated attacker to...

Information Disclosure

centreon/centreon is vulnerable to information disclosure. Lack of proper validation of user supplied strings while processing virtual metrics inDB-Func.php allows authenticated attackers to gain access to confidential user information such as stored credentials...

CVE-2022-1853

Use after free in Indexed DB in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page...

CVE-2022-1853

Use after free in Indexed DB in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page...

CVE-2022-1853

Use after free in Indexed DB in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page...

Double free

Use after free in Indexed DB in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page...

CVE-2022-1853

Use after free in Indexed DB in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page...

CVE-2022-1853

CVE-2022-1853 involves a use-after-free in IndexedDB in Google Chrome, prior to version 102.0.5005.61. The underlying issue allowed a remote attacker to potentially escape the Chrome sandbox via a crafted HTML page. Connected sources confirm the flaw affects Chrome’s IndexedDB handling and was ad...

CVE-2022-1853

Use after free in Indexed DB in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page...

CVE-2022-1853

Use after free in Indexed DB in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page...

MAL-2022-2363 Malicious code in db-dolphin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f31c91df2858e430559be9af39930325d40063e82634ee7dff673a2d7fab5cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in db-dolphin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f31c91df2858e430559be9af39930325d40063e82634ee7dff673a2d7fab5cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Elementor Contact Form DB <= 1.7 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by ZhongFu Su aka JrXnm WuHan University in WordPress Elementor Contact Form DB versions = 1.7. Solution Update the WordPress Elementor Contact Form DB plugin to the latest available version at least 1.8...

[PNM-003] The preimage DB (i.e., NameWrapper.names) can be maliciously manipulated/corrupted

Lines of code Vulnerability details Description By design, the NameWrapper.names is used as a preimage DB so that the client can query the domain name by providing the token ID. The name should be correctly stored. To do so, the NameWrapper record the domain's name every time it gets wrapped. And...

GHSA-5PGM-3J3G-2RC7 Valinor error messages leading to potential data exfiltration before v0.12.0

php registerConstructorMoney::class, 'fromString' -mapper; try vardump$mapper-mapFoo::class, 'a' = 'HAHA', 'b' = '100 EUR', 'c' = 'USD 100' ; catch MappingError $e $messages = new NodeTraverserfunction Node $node foreach $node-messages as $message vardump '$message', $message-path, $message-body ...

AZL-10606 CVE-2022-32081 affecting package mariadb for versions less than 10.6.9-1

MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepareinplaceaddvirtual at /storage/innobase/handler/handler0alter.cc...

CVE-2022-32084

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component subselect...

WiFi Mouse 1.7.8.5 - Remote Code Execution Exploit (2)

Exploit Title: WiFi Mouse 1.7.8.5 - Remote Code Execution Author: H4rk3nz0 Vendor Homepage: http://necta.us/ Software Link: http://wifimouse.necta.us/download Version: 1.7.8.5 Tested on: Windows Enterprise Build 17763 ​ Python 3 port done by RedHatAugust Original exploit:...