Denial Of Service (DoS)

firefox is vulnerable to denial of service. The vulnerability exists during the navigations between XML documents causing a use-after-free which then leads an application crash...

Design/Logic Flaw

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.111 the title of a document is not properly escaped in the search result of MyDocmanSearch widget and in the administration page of the locked documents. A malicious...

Tuleap 跨站脚本漏洞

Tuleap is an application lifecycle management system that facilitates agile software development, design projects, V-models, requirements management and IT service management.A cross-site scripting vulnerability exists in versions prior to Tuleap 13.9.99.111, which stems from a failure to properl...

PT-2022-11429 · Silverstripe · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: Silverstripe silverstripe/framework versions 4.8.1 through 4.10.9 Description: The issue is related to a quadratic blowup in the Convert::xml2array function, which can be exploited via a crafted XML document to enable a remote attack...

silverstripe framework 资源管理错误漏洞

silverstripe framework is a CMS web framework. A security vulnerability exists in silverstripe framework version 4.8.1. An attacker can exploit this vulnerability to conduct remote attacks via specially crafted XML documents...

MantisBT XSS through crafted SVG documents in file_download.php

An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin clicks on the attachment, filedownload.php opens the SVG document in a browser tab instead of downloading it as a file, causing the JavaScri...

Cross-site Scripting (XSS)

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the filedownload.php process. An attacker can execute arbitrary JavaScript code by attaching and triggering malicious SVG documents. Details Cross-site scripting or...

GHSA-QGHG-V7XV-Q98Q MantisBT XSS through crafted SVG documents in file_download.php

An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin clicks on the attachment, filedownload.php opens the SVG document in a browser tab instead of downloading it as a file, causing the JavaScri...

CVE-2022-33910

CVE-2022-33910 affects MantisBT before 2.25.5. Affected area: attaching crafted SVG documents to issue reports or bugnotes. Root cause: file_download.php opens the SVG in a browser tab instead of downloading it as a file, enabling JavaScript execution in the context of the user’s browser. Impact:...

The vulnerability of the library for viewing, printing, rendering, creating, and processing PDF files. The PDFTron SDK software from Autodesk allows a perpetrator to execute arbitrary code.

The vulnerability of the PDFTron SDK software’s library for viewing, printing, rendering, creating, and processing PDF files is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code in the context of the current...

MAL-2022-3578 Malicious code in head-dlb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c4e3fe4404a2dcb3ba9f86c02229e85e2bf8bceff38f5f7f0e00afec38faec7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in perf-search-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb586cca0b2de02fff1057f548dba4887dd3b2ffaec498d2fb80432bef8ec9f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in search-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d766a559ac60a5a49bdcf49f60e171420b152d4eb98b8f941c094927f0a5058 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5989 Malicious code in search-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d766a559ac60a5a49bdcf49f60e171420b152d4eb98b8f941c094927f0a5058 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @azure-tests/perf-search-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f2237723a6fdf9b67623ef054f822f99d0e07663d04182ba616f88121f800b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-search-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 593f8130bfe080437256f79540f957cb19721fc1caa66b41f5874e0f0fbcc80d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1375 Malicious code in azure-search-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 593f8130bfe080437256f79540f957cb19721fc1caa66b41f5874e0f0fbcc80d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Reddit: Unrestricted File Upload on reddit.secure.force.com

Summary: Reddit.secure.force.com is Reddit SalesForce instance. Attacker is able to send attachments of disallowed filetypes to this server. The attacker is able to send malicious documents such as CVE-2022-30190 Follina to the victim. Impact: Attacker can send malicious files to whoever handles...

Malicious code in metamask-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 61c1b1a606468376d3cb2a636e220c258458fdc1f12980fc4d21644b7f6197b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Libmobi Denial of Service Vulnerability (CNVD-2022-54978)

Libmobi is a C library for handling Mobipocket/Kindle MOBI e-book format documents. It is used to process Mobipocket/Kindle MOBI e-book format documents. A denial of service vulnerability exists in versions of Libmobi prior to v0.10, which stems from the component mobibuffergetpointer cancelling...