SQL Injection Vulnerability in xdcms Frontend

xdcms is an open source, general purpose content management system. A SQL injection vulnerability exists in the frontend of xdcms, which can be exploited by attackers to obtain sensitive database information...

Cross site scripting

Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the miccomment field Notes on time when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting...

CVE-2021-24147 Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS)

Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the miccomment field Notes on time when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting...

SQL Injection Vulnerability in Ke361 Frontend Go*** Functions

Ke361 is an open source Taobao system. Ke361 front-end Go function has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database data...

SQL Injection Vulnerability in Ke361 Frontend Ho*** Functions

Ke361 is an open source Taobao system. Ke361 front-end Ho function SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive database data...

XSS vulnerability in 115cms frontend (CNVD-2021-28389)

115CMS is developed using the current most popular ThinkPHP framework, which is an efficient and open source content management system. 115cms frontend has an XSS vulnerability that can be exploited by attackers to obtain user cookie information...

Wordpress Photo Gallery SQL注入漏洞

Wordpress Photo Gallery is Wordpress open source an application plugin . It provides a feature to add responsive galleries and photo albums to a website. A SQL injection vulnerability exists in the WordPress Photo Gallery plugin, which originates from the frontend/models/model.php bwgsearchx...

SQL Injection Vulnerability in Ke361 Frontend

Ke361 is an open source Taobao system. Ke361 frontend has a SQL injection vulnerability. Attackers can exploit the vulnerability to obtain sensitive information in the database...

Cross-site Scripting (XSS)

ceph dashboard is vulnerable to cross-site scripting XSS attacks. The JSON Web Token JWT used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks...

Updated kernel packages fix security issues and possible filesystem corruption

This kernel update is based on upstream 5.10.20 and fixes at least the following security issues: A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way the user calls ioctl DRMIOCTLNOUVEAUCHANNELALLOC. This flaw...

Design/Logic Flaw

An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. A certain part of the netback driver lacks necessary treatment of errors such as failed memory allocations as a result of changes to the handling of grant mapping errors. A host OS denial of service may occur during...

CVE-2021-28038

An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. A certain part of the netback driver lacks necessary treatment of errors such as failed memory allocations as a result of changes to the handling of grant mapping errors. A host OS denial of service may occur during...

Stack overflow

Stack-based buffer overflow vulnerability in frontend/main.c in faad2 before 2.2.7.1 allow local attackers to execute arbitrary code via filename and pathname options...

CVE-2021-26567

Summary: CVE-2021-26567 is a stack-based buffer overflow in the FAAD2 decoder (frontend/main.c) of faad2 prior to 2.2.7.1. The vulnerability allows a local attacker to execute arbitrary code via crafted filename and pathname options. Affected context is mainly Synology DiskStation Manager (faad2 ...

Linux: backends treating grant mapping errors as bugs

ISSUE DESCRIPTION Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests, like out of memory conditions, it isn't correct to assume so. Memory allocations potentially causing such...

Debian DLA-2557-1 : linux-4.19 security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2020-27815 A flaw was reported in the JFS filesystem code allowing a local attacker with the ability to set extended attributes to cause a denial o...

Cross-site Scripting (XSS) - Generic in ciur/papermerge-js

Description Papermerge is an open source document management system DMS primarily designed for archiving and retrieving your digital documents. Instead of having piles of paper documents all over your desk, office or drawers - you can quickly scan them and configure your scanner to directly uploa...

Project iKy v2.7.0 - Tool That Collects Information From An Email And Shows Results In A Nice Visual Interface

Project iKy is a tool that collects information from an email and shows results in a nice visual interface. Visit the Gitlab Page of the Project Installation Clone repository git clone https://gitlab.com/kennbroorg/iKy.git Install Backend Redis You must install Redis wget...

CVE-2021-21436

Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7.0.x version 7.0.14 and prior versions...

UBUNTU-CVE-2021-21436

Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7.0.x version 7.0.14 and prior versions...