CVE-2022-40317

OpenKM 6.3.11 allows stored XSS related to the javascript substring in an A element...

SAP BusinessObjects BW Publisher Service Privilege Escalation

The vulnerability of the SAP BusinessObjects BW Publisher Service software integration platform is related to the absence of commas in the syntax of elements or search paths. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2022-40317: Improper Neutralization of Input During Web Page Generation

OpenKM 6.3.11 allows stored XSS related to the javascript substring in an A element...

OpenKM cross-site scripting vulnerability

OpenKM is a document management system from OpenKM Spain. The system provides features such as version control, document history and file sharing. A security vulnerability exists in OpenKM version 6.3.11, which originates from a stored cross-site script that can be realized by an attacker via a...

PT-2022-25345 · Openkm · Openkm

Name of the Vulnerable Software and Affected Versions: OpenKM version 6.3.11 Description: The issue allows stored XSS related to the javascript: substring in an A element. This could potentially lead to malicious script execution when a user interacts with the affected element. Recommendations: F...

Ruby on Rails: ActionView sanitize helper bypass leading to XSS using SVG tag.

An HTML sanitization bypass vulnerability was discovered in the ActionView sanitize helper. This allowed an attacker to bypass sanitization and execute cross-site scripting XSS attacks by using the use tag of the SVG element. By embedding a base64 encoded SVG with malicious code, an attacker coul...

Huawei HarmonyOS path traversal vulnerability

Huawei HarmonyOS is an operating system from Huawei China Inc. A path traversal vulnerability exists in Huawei HarmonyOS, which stems from the failure of the number identification module to properly filter special elements in the path of a resource or file. An attacker could exploit this...

Fedora 36 : thunderbird (2022-8bf22a684b)

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-8bf22a684b advisory. Update to 102.2.1 ; https://www.mozilla.org/en-US/security/advisories/mfsa2022-38/ Tenable has extracted the preceding description block directly from the...

CVE-2022-3034

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of sending a request to the remote document when receiving an HTML email that specified to load an iframe element from a remote location. However, Thunderbird didn't display the document...

CVE-2022-2006 AutomationDirect C-more EA9 HMI Uncontrolled Search Path Element

AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to...

PT-2022-4580

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 105.0.5195.52 Lacros versions prior to 105.0.5195.52 Description The issue is related to a use after free in the Tab Strip element, which can lead to heap corruption. A remote attacker who convinces a user to...

GHSA-XFHG-9PJG-XG7G VTK NULL pointer dereference vulnerability

There is a NULL pointer dereference vulnerability in VTK, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe as the return value can be NULL and that NULL pointer dereference may...

Raptor Heap Buffer Overflow DoS

The vulnerability of the raptorxmlwriterstartelementcommon function in the Raptor library is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

DEBIAN-CVE-2021-42521

There is a NULL pointer dereference vulnerability in VTK before 9.2.5, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe as the return value can be NULL and that NULL pointer...

CVE-2021-42521

There is a NULL pointer dereference vulnerability in VTK before 9.2.5, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe as the return value can be NULL and that NULL pointer...

UBUNTU-CVE-2021-42521

There is a NULL pointer dereference vulnerability in VTK before 9.2.5, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe as the return value can be NULL and that NULL pointer...

PYSEC-2022-255

There is a NULL pointer dereference vulnerability in VTK, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe as the return value can be NULL and that NULL pointer dereference may...

PYSEC-2022-255

There is a NULL pointer dereference vulnerability in VTK, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe as the return value can be NULL and that NULL pointer dereference may...

AVEVA Edge SCADA Uncontrolled Element Command Execution Privilege Escalation

The vulnerability of the AVEVA Edge SCADA system is related to an uncontrolled element in the search process. Exploiting this vulnerability could allow a attacker to execute arbitrary code or increase their privileges...

AVEVA Edge SCADA Uncontrolled Element Command Execution Privilege Escalation

The vulnerability of the AVEVA Edge SCADA system is related to an uncontrolled element in the search process. Exploiting this vulnerability can allow a hacker to execute arbitrary code or increase their privileges...