Medium: qemu

Issue Overview: A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device. This flaw allows a privileged guest user to crash the QEMU process on t...

WordPress Plugin display-metadata 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

CVE-2023-29747

Story Saver for Instragram - Video Downloader 1.0.6 for Android exists exposed component, the component provides the method to modify the SharedPreference file. The attacker can use the method to modify the data in any SharedPreference file, these data will be loaded into the memory when the...

PT-2023-10287 · Meitar · Meitar Inline Google Spreadsheet Viewer Plugin

Name of the Vulnerable Software and Affected Versions: meitar Inline Google Spreadsheet Viewer Plugin versions up to 0.9.6 Description: A vulnerability was found in the meitar Inline Google Spreadsheet Viewer Plugin, which is classified as problematic. The issue affects the displayShortcode...

CVE-2023-33180

Xibo is a content management system CMS. An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.2 in the /display/map API route inside the CMS. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted valu...

CVE-2023-33180

CVE-2023-33180 affects Xibo CMS. An SQL injection in the /display/map API route allows an authenticated user to exfiltrate data from the Xibo database via crafted values in the bounds parameter. Vulnerable versions: 3.2.0 through 3.3.2. Fix: upgrade to version 3.3.5 (upgrading is the recommended ...

CVE-2023-29732

SoLive 1.6.14 thru 1.6.20 for Android exists exposed component, the component provides the method to modify the SharedPreference file. The attacker can use the method to modify the data in any SharedPreference file, these data will be loaded into the memory when the application is opened. Dependi...

PT-2023-24197 · Xibo · Xibo

Name of the Vulnerable Software and Affected Versions: Xibo versions 3.2.0 through 3.3.2 Description: A SQL injection issue was discovered in the /display/map API route, allowing an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values into the bounds...

CVE-2023-29732

SoLive 1.6.14 thru 1.6.20 for Android exists exposed component, the component provides the method to modify the SharedPreference file. The attacker can use the method to modify the data in any SharedPreference file, these data will be loaded into the memory when the application is opened. Dependi...

PT-2023-22383 · Solive · Solive

Name of the Vulnerable Software and Affected Versions: SoLive versions 1.6.14 through 1.6.20 for Android Description: The issue concerns an exposed component that provides a method to modify the SharedPreference file. An attacker can exploit this to modify data in any SharedPreference file, which...

CVE-2023-28153

An issue was discovered in the Kiddoware Kids Place Parental Control application before 3.8.50 for Android. The child can remove all restrictions temporarily without the parents noticing by rebooting into Android Safe Mode and disabling the "Display over other apps" permission...

CVE-2023-28153

An issue was discovered in the Kiddoware Kids Place Parental Control application before 3.8.50 for Android. The child can remove all restrictions temporarily without the parents noticing by rebooting into Android Safe Mode and disabling the "Display over other apps" permission...

PT-2023-21599 · Kiddoware · Kiddoware Kids Place Parental Control

Name of the Vulnerable Software and Affected Versions: Kiddoware Kids Place Parental Control version prior to 3.8.50 Description: An issue in the Kiddoware Kids Place Parental Control application allows a child to temporarily remove all restrictions without the parents noticing. This can be...

Liferay Portal 7.4.3.50 < 7.4.3.51 XSS

Cross-site scripting XSS vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a web content article's Title field. Not...

Cross-site scripting in Liferay Portal

Cross-site scripting XSS vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a web content article's Title field...

GHSA-WV99-WMPF-JRQR Cross-site scripting in Liferay Portal

Cross-site scripting XSS vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a web content article's Title field...

CVE-2023-33942

Cross-site scripting XSS vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a web content article's Title field...

CVE-2023-33942

Cross-site scripting XSS vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a web content article's Title field...

Cross site scripting

Cross-site scripting XSS vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a web content article's Title field...

CVE-2023-33942

Cross-site scripting XSS vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a web content article's Title field...