EulerOS 2.0 SP8 : python2 (EulerOS-SA-2022-1581)

According to the versions of the python2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator URL strings into...

Huawei EulerOS: Security Advisory for python2 (EulerOS-SA-2022-1581)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CLSA-2022-1650377131 Fix CVE(s): CVE-2022-28391

SECURITY UPDATE: possible remote code execution - debian/patches/CVE-2022-28391.patch: fix possible terminal injection attacks from DNS query results - CVE-2022-28391...

CScms SQL Injection Vulnerability (CNVD-2022-33154)

CScms is a content management system CMS developed based on the CI framework.Cscms Music Portal System v4.2 is vulnerable to SQL injection, which can be exploited by attackers to conduct injection attacks via the component danceDance.phphy...

CScms SQL Injection Vulnerability (CNVD-2022-33155)

CScms is a content management system CMS developed based on the CI framework. CScms is vulnerable to SQL injection, which can be exploited by attackers to conduct injection attacks via the component danceDance.phpdel...

SUSE SLED12 / SLES12 Security Update : python (SUSE-SU-2022:1140-1)

The remote SUSE Linux SLED12 / SLEDSAP12 / SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1140-1 advisory. - A flaw was found in Python, specifically in the FTP File Transfer Protocol client library in PASV passive...

openSUSE 15 Security Update : python (openSUSE-SU-2022:1091-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:1091-1 advisory. - A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issu...

CVE-2021-46007

totolink a3100r V5.9c.4577 is vulnerable to os command injection. The backend of a page is executing the "ping" command, and the input field does not adequately filter special symbols. This can lead to command injection attacks...

CVE-2021-46007

totolink a3100r V5.9c.4577 is vulnerable to os command injection. The backend of a page is executing the "ping" command, and the input field does not adequately filter special symbols. This can lead to command injection attacks...

SPEL Expression Injection Vulnerability in Spring Cloud Function

Spring Cloud Function is a functional computing framework based on Spring Boot.Spring Cloud Function is vulnerable to SPEL expression injection, which can be exploited by attackers to perform injection attacks remotely via SPEL expression injection...

A Search for API Security in the Operator’s Tool Box

Much has been written about modern application security tools and solutions from the provider’s perspective about their functionality and security features. When I was asked to write a blog about API Gateways and API Security, I felt it may be more useful to think about the subject from the user’...

SUSE SLES12: libpython3_4m1_0 / libpython3_4m1_0-32bit / python3 / python3-base / etc (SUSE-SU-2022:0882-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0882-1 advisory. - CVE-2021-4189: Fixed default access from PASV response in the FTP client bsc1194146. - CVE-2022-0391: Fixed sanitizing of URLs...

WordPress Conversios.io plugin SQL injection vulnerability

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress plugin is an application plugin for WordPress. SQL injection vulnerability exists in versions of WordPress...

GHSA-X8XX-X82Q-42Q3 Exposure of Resource to Wrong Sphere in ezsystems/ezplatform-kernel

When image files are uploaded, they are made accessible under a name similar to the original file name. There are two issues with this. Both require access to uploading images in order to exploit them, this limits the impact. The first issue is that certain injection attacks can be possible, sinc...

Design/Logic Flaw

Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows injection attacks via image filenames...

CVE-2022-25337

The CVE-2022-25337 entry affects Ibexa DXP ezsystems/ezpublish-kernel versions 7.5.x before 7.5.26 and 1.3.x before 1.3.12, where image filename handling allows injection attacks. The connected sources confirm the vulnerability is tied to image filename sanitization issues, enabling injection thr...

Python urllib.parse Vulnerability (bpo-43882) - Windows

Python is prone to a vulnerability urllib.parse. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python"; ifdescription...

Python urllib.parse Vulnerability (bpo-43882) - Mac OS X

Python is prone to a vulnerability urllib.parse. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python"; ifdescription...

Python urllib.parse Vulnerability (bpo-43882) - Linux

Python is prone to a vulnerability urllib.parse. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python"; ifdescription...

GHSA-RHG5-FQR3-HRF5 Injection in DeltaSpike

we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. This is only active if a developer selected the ClientSideWindowStrategy which is not the default...