Virtuozzo Hybrid Infrastructure 5.1 (5.1.0-206)

In this release, Virtuozzo Hybrid Infrastructure provides a wide range of new features that enhance service providers' interoperability and help to expand their services. The improvements cover compute services, security, core storage, and the user interface. Additionally, this release delivers...

Buffer overflow

Azure RTOS USBX is a USB host, device, and on-the-go OTG embedded stack. Prior to version 6.1.11, he USBX DFU UPLOAD functionality may be utilized to introduce a buffer overflow resulting in overwrite of memory contents. In particular cases this may allow an attacker to bypass security features o...

Design/Logic Flaw

Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration'...

CVE-2022-25229

Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Servers' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands...

Cross site scripting

Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Servers' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands...

CVE-2022-25224

Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration'...

Basic SEO Features (seo_basics) extension TYPO3 vulnerable to Cross-site Scripting

Cross-site scripting XSS vulnerability in Basic SEO Features seobasics extension before 0.8.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

GHSA-7P53-8WJR-J8H4 Basic SEO Features (seo_basics) extension TYPO3 vulnerable to Cross-site Scripting

Cross-site scripting XSS vulnerability in Basic SEO Features seobasics extension before 0.8.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2022-20427 · Jenkins · Jenkins Autocomplete Parameter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Autocomplete Parameter Plugin versions 1.1 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the plugin references certain parameter names in an unsafe manner from...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.4 <=2.0.8), br.net.woodstock.rockframework:rockframework-persistence (>=2.0.0 <=2.0.8) +422 more potentially affected by CVE-2013-1768 via org.apache.openjpa:openjpa (>=2.0.0 <=2.2.1)

org.apache.openjpa:openjpa MAVEN version =2.0.0, =1.2.4, =2.0.0, =1.0.0, =1.0.0, =18.0.0.3, =18.0.0.3, =18.0.0.3, =18.0.0.3, =18.0.0.3, =18.0.0.3, =18.0.0.3, =1.0.0, =0.20, =0.20, =2.1.0-rc.3 and more Source cves: CVE-2013-1768 Source advisory: OSV:GHSA-J65F-MVGW-PRP2...

net.osgiliath.framework:net.osgiliath.features.karaf-features-full (>=0.0.1 <=0.0.3), net.osgiliath.framework:net.osgiliath.features.karaf-features-jpa (>=0.0.1 <=0.0.3) +48 more potentially affected by CVE-2015-7501 via org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections (>=3.2.1_1 <=3.2.1_3)

org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections MAVEN version =3.2.11, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.2.0, =1.0.2, =1.0.8 - org.frie...

MGASA-2022-0168 Updated python-twisted packages fix security vulnerability

CVE-2022-21712: It was discovered that Twisted incorrectly filtered HTTP headers when clients are being redirected to another origin. A remote attacker could use this issue to obtain sensitive information. CVE-2022-21716: It was discovered that Twisted incorrectly processed SSH handshake data on...

Android 13 Tries to Make Privacy and Security a No-Brainer

With its latest mobile OS update, Google aims to simplify the adoption of Android’s protective features for users and developers alike...

CVE-2021-26376

Insufficient checks in System Management Unit SMU FeatureConfig may result in reenabling features potentially resulting in denial of resources and/or denial of service...

[SECURITY] Fedora 36 Update: golang-github-francoispqt-gojay-1.2.13-6.fc36

GoJay is a performant JSON encoder/decoder for Golang currently the most performant, see benchmarks. It has a simple API and doesn't use reflection. It relies on small interfaces to decode/encode structures and slices. Gojay also comes with powerful stream decoding features and an even faster...

CVE-2022-29423

Pro Features Lock Bypass vulnerability in Countdown & Clock plugin = 2.3.2 at WordPress...

CVE-2022-29423

Pro Features Lock Bypass vulnerability in Countdown & Clock plugin = 2.3.2 at WordPress...

CVE-2022-29423 WordPress Countdown & Clock plugin <= 2.3.2 - Pro Features Lock Bypass vulnerability

Pro Features Lock Bypass vulnerability in Countdown & Clock plugin = 2.3.2 at WordPress...

CVE-2022-29423 WordPress Countdown & Clock plugin <= 2.3.2 - Pro Features Lock Bypass vulnerability

Pro Features Lock Bypass vulnerability in Countdown & Clock plugin = 2.3.2 at WordPress...

PT-2022-19596 · WordPress · Countdown & Clock

Name of the Vulnerable Software and Affected Versions: Countdown & Clock plugin versions prior to 2.3.3 Description: A Pro Features Lock Bypass issue affects the Countdown & Clock plugin at WordPress. The issue allows bypassing of pro features locks. Recommendations: For versions prior to 2.3.3,...