2914 matches found
GHSA-HQ4R-47QC-3JHC MicroPyramid Django-CRM CSRF
MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users//edit/, and /accounts//delete/ URIs...
Adobe InDesign Code Execution Vulnerability (CNVD-2022-76625)
A security vulnerability exists in Adobe InDesign, a set of typesetting and editing applications from Adobe. The vulnerability stems from a networked system or product that does not properly validate data boundaries when performing operations on memory, and can be exploited by an attacker to...
Adobe InCopy Memory Misreference Vulnerability
Adobe InCopy is a text editing software for authoring from Adobe U.S.A. A memory mis-reference vulnerability exists in Adobe InCopy, which stems from a mix-up in the program's instructions for freeing memory. An attacker could exploit this vulnerability to execute arbitrary code on the system...
Adobe InCopy out-of-bounds write vulnerability (CNVD-2022-45913)
A security vulnerability exists in Adobe InCopy, a text editing software for authoring from Adobe. The vulnerability stems from a networked system or product that does not properly validate data boundaries when performing operations on memory, and can be exploited by attackers to cause arbitrary...
CVE-2021-31330
A Cross-Site Scripting XSS vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier. An authenticated attacker may inject malicious Javascript code when using Markdown editing within the application which remains persistent...
CVE-2021-31330
A Cross-Site Scripting XSS vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier. An authenticated attacker may inject malicious Javascript code when using Markdown editing within the application which remains persistent...
Cross site scripting
A Cross-Site Scripting XSS vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier. An authenticated attacker may inject malicious Javascript code when using Markdown editing within the application which remains persistent...
CVE-2021-31330
A Cross-Site Scripting XSS vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier. An authenticated attacker may inject malicious Javascript code when using Markdown editing within the application which remains persistent...
PT-2022-10034 · Unknown · Review Board
Name of the Vulnerable Software and Affected Versions: Review Board versions 3.0.20 and earlier Review Board versions 4.0 RC1 and earlier Description: A Cross-Site Scripting XSS issue exists, allowing an authenticated attacker to inject malicious Javascript code when using Markdown editing within...
ALSA-2022:2120 Moderate: zsh security update
The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command processor. Zsh resembles the ksh shell the Korn shell, but includes many enhancements. Zsh supports command-line editing, built-in spelling correction, programmable command completion, shell...
User Meta < 2.4.3 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting them in the admin dashboard when editing a form, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed An an admin - Create/edit ...
CVE-2022-29903
The Private Domains extension for MediaWiki through 1.37.2 before 1ad65d4c1c199b375ea80988d99ab51ae068f766 allows CSRF for editing pages that store the extension's configuration. The attacker must trigger a POST request to Special:PrivateDomains...
Chromium: CVE-2022-1492 Insufficient data validation in Blink Editing
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
KLA12519 Multiple vulnerabilities in Microsoft Browser
Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, bypass security restrictions, gain privileges, spoof user interface. Below is a complete list of vulnerabilities: 1. Use after free...
CVE-2022-24881 Command Injection in Ballcat Codegen
Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2, attackers can implement remote code execution through malicious code injection of the template engine. This happens because Velocity and freemarker templates are introduced but...
chromium -- multiple vulnerabilities
Chrome Releases reports: This release contains 30 security fixes, including: 1313905 High CVE-2022-1477: Use after free in Vulkan. Reported by SeongHwan Park SeHwa on 2022-04-06 1299261 High CVE-2022-1478: Use after free in SwiftShader. Reported by SeongHwan Park SeHwa on 2022-02-20 1305190 High...
CVE-2021-24800
The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to edit belongs to the user making the request, allowing any user to edit other comments...
CVE-2021-24800
The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to edit belongs to the user making the request, allowing any user to edit other comments...
Design/Logic Flaw
The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to edit belongs to the user making the request, allowing any user to edit other comments...
