SUSE SLES12: libpython3_4m1_0 / libpython3_4m1_0-32bit / python3 / python3-base / etc (SUSE-SU-2022:0882-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0882-1 advisory. - CVE-2021-4189: Fixed default access from PASV response in the FTP client bsc1194146. - CVE-2022-0391: Fixed sanitizing of URLs...

WordPress Conversios.io plugin SQL injection vulnerability

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress plugin is an application plugin for WordPress. SQL injection vulnerability exists in versions of WordPress...

GHSA-X8XX-X82Q-42Q3 Exposure of Resource to Wrong Sphere in ezsystems/ezplatform-kernel

When image files are uploaded, they are made accessible under a name similar to the original file name. There are two issues with this. Both require access to uploading images in order to exploit them, this limits the impact. The first issue is that certain injection attacks can be possible, sinc...

Design/Logic Flaw

Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows injection attacks via image filenames...

CVE-2022-25337

The CVE-2022-25337 entry affects Ibexa DXP ezsystems/ezpublish-kernel versions 7.5.x before 7.5.26 and 1.3.x before 1.3.12, where image filename handling allows injection attacks. The connected sources confirm the vulnerability is tied to image filename sanitization issues, enabling injection thr...

PT-2022-17220

Name of the Vulnerable Software and Affected Versions Ibexa DXP ezsystems/ezpublish-kernel versions 7.5.x through 7.5.25 Ibexa DXP ezsystems/ezpublish-kernel versions 1.3.x through 1.3.11 Description The issue allows injection attacks via image filenames when image files are uploaded. This is...

Python urllib.parse Vulnerability (bpo-43882) - Linux

Python is prone to a vulnerability urllib.parse. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python"; ifdescription...

Python urllib.parse Vulnerability (bpo-43882) - Windows

Python is prone to a vulnerability urllib.parse. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python"; ifdescription...

Python urllib.parse Vulnerability (bpo-43882) - Mac OS X

Python is prone to a vulnerability urllib.parse. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python"; ifdescription...

GHSA-RHG5-FQR3-HRF5 Injection in DeltaSpike

we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. This is only active if a developer selected the ClientSideWindowStrategy which is not the default...

Hospital Management Startup 1.0 - (Multiple) SQL injection Vulnerability

Exploit Title: Hospital Management Startup 1.0 - 'loginid' SQLi Exploit Author: nu11secur1ty Vendor: https://github.com/kabirkhyrul Software: https://github.com/kabirkhyrul/HMS CVE-2022-23366 Description: The loginid and password parameters from Hospital Management Startup 1.0 appear to be...

Design/Logic Flaw

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator URL strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an...

CVE-2022-0391

CVE-2022-0391 affects the Python urllib.parse.urlparse path handling, where input is not sanitized and allows literal CR/LF characters, enabling crafted URLs to trigger injection-like issues. Public docs (Python history, Debian LTS/DLA notes, Astra Linux bulletin) corroborate that the vulnerabili...

Mageia: Security Advisory (MGASA-2014-0488)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-0391

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator URL strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an...

GHSA-44M4-9CJP-J587 IBX-1392: Image filenames sanitization

ezsystems/ezpublish-kernel versions 7.5. before 7.5.26 are vulnerable to certain injection attacks and unauthorized access to some image files...

IBX-1392: Image filenames sanitization

ezsystems/ezpublish-kernel versions 7.5. before 7.5.26 are vulnerable to certain injection attacks and unauthorized access to some image files...

PT-2022-28187

Name of the Vulnerable Software and Affected Versions ezsystems/ezpublish-kernel versions 7.5. before 7.5.26 Description The issue allows for certain injection attacks and unauthorized access to some image files. Recommendations For ezsystems/ezpublish-kernel versions 7.5. before 7.5.26, update t...

What is API Abuse ❓ Prevention measures.

APIs are paramount for constructing a steadfast and constant communication bridge that empowers devices to pass-on desired information seamlessly. Hackers adopt many ways to exploit the APIs and corrupt the targeted device. This API exploitation is a potential threat to API security and needs...

What is API Abuse ❓ Prevention measures.

APIs are paramount for constructing a steadfast and constant communication bridge that empowers devices to pass-on desired information seamlessly. Hackers adopt many ways to exploit the APIs and corrupt the targeted device. This API exploitation is a potential threat to API security and needs...