980 matches found
Huawei EulerOS: Security Advisory for perl-Encode (EulerOS-SA-2022-2433)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
EulerOS 2.0 SP10 : perl-Encode (EulerOS-SA-2022-2433)
According to the versions of the perl-Encode package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library in th...
EulerOS 2.0 SP10 : perl-Encode (EulerOS-SA-2022-2420)
According to the versions of the perl-Encode package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library in th...
Kadence WooCommerce Email Designer < 1.5.7 - Admin+ PHP Objection Injection
The plugin unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import intentionally or not a malicious file and a suitable gadget chain is present on the blog. To simulate a gadget chain, put the following code in a plugin class Evil public...
PT-2022-37310 · Oracle · Java
Name of the Vulnerable Software and Affected Versions: java versions affected versions not specified Description: The issue is related to a security exception. Technical details about the crash include the Parser.parseConditionalExpression function and the CESU 8$Encoder.encodeLoop method in...
Cross-site Scripting (XSS)
craftcms/cms is vulnerable to cross-site scripting. The vulnerability exists because the fldTabHtml and fldFieldSelectorsHtml functions of Cp.php does not properly encode the tab and groupName parameters, allowing an attacker to inject and execute malicious javascript...
Download Monitor < 4.5.98 - Admin+ Arbitrary File Download
The plugin does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup. Create a new download on:...
The vulnerability of the encode_structured_data method in the PyPI eth-account package allows a attacker to cause a service failure.
The vulnerability of the encodestructureddata method in the PyPI package eth-account is related to incorrect data input used as a condition for loop execution. Exploiting this vulnerability could allow an attacker to cause service failures...
PT-2022-5380
Name of the Vulnerable Software and Affected Versions GNU Libtasn1 versions prior to 4.19.0 Description The issue is related to an off-by-one error in the asn1 encode simple der function of the Libtasn1 library. This can be exploited by a remote attacker to disclose protected information or cause...
PT-2022-37213 · Git +1 · Opensc
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-double-free crash. Technical details about the crash include the function names sc pkcs15 encode df, sc pkcs15init update...
Security feature bypass
An exponential ReDoS Regular Expression Denial of Service can be triggered in the eth-account PyPI package, when an attacker is able to supply arbitrary input to the encodestructureddata method...
PT-2022-4437
Name of the Vulnerable Software and Affected Versions eth-account affected versions not specified Description The issue is related to an exponential ReDoS Regular Expression Denial of Service that can be triggered in the eth-account PyPI package. This occurs when an attacker is able to supply...
eth_account 安全漏洞
ethaccount is an ethereum account generator. A security vulnerability exists in versions of ethaccount prior to 0.5.9, which can be exploited by an attacker to trigger an exponential ReDoS in the eth-account PyPI package when providing arbitrary input to the encodestructureddata method...
Malicious code in hexie-encode (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d480e2cc2e535605e7caaa7981e20f5ee3d64e5a0629c5196070869acc7e5a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-3617 Malicious code in hexie-encode (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d480e2cc2e535605e7caaa7981e20f5ee3d64e5a0629c5196070869acc7e5a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
UBUNTU-CVE-2022-36144
SWFMill commit 53d7690 was discovered to contain a heap-buffer overflow via base64encode...
mPDF 7.0 - Local File Inclusion Exploit
Exploit Title: mPDF 7.0 - Local File Inclusion Exploit Author: Musyoka Ian Vendor Homepage: https://mpdf.github.io/ Software Link: https://mpdf.github.io/ Version: CuteNews Tested on: Ubuntu 20.04, mPDF 7.0.x CVE: N/A !/usr/bin/env python3 from urllib.parse import quote from cmd import Cmd from...
Cross-site Scripting (XSS)
subhh/libconnect is vulnerable to cross-site scriptingXSS attacks. The library does not properly encode the user input in displayParticipantsFormAction function, allowing an attacker to inject and execute malicious javascript on the target system...
The vulnerability of the decode/encodeBody component in the Envoy proxy server allows a attacker to induce a service failure.
The vulnerability of the decode/encodeBody component in the Envoy proxy server is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by uploading a specially created zip file...
brotkrueml/schema fails to properly encode user input for output in HTML context, leading to XSS
The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability...