Fedora: Security Advisory for lua (FEDORA-2022-93f064549c)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 34 Update: prosody-0.11.12-1.fc34

Prosody is a flexible communications server for Jabber/XMPP written in Lua. It aims to be easy to use, and light on resources. For developers it aims to be easy to extend and give a flexible system on which to rapidly develop added functionality, or prototype new protocols...

ILM OpenEXR Buffer Overflow Vulnerability

ILM OpenEXR is an image file format from Industrial Light and Magic ILM for high dynamic range HDR images. ILM OpenEXR is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to cause a buffer overflow...

ILM OpenEXR 缓冲区错误漏洞

ILM OpenEXR is an image file format from Industrial Light and Magic ILM for high dynamic range HDR images. ILM OpenEXR is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to cause a buffer overflow...

GHSA-F3W5-V9XX-RP8P Signature verification failure in Tendermint

The root cause of this security vulnerability is in the Tendermint specification, and this advisory is a duplicate of https://github.com/tendermint/spec/security/advisories/GHSA-jqfc-687g-59pw. Impact Tendermint light clients running versions 0.34.0 to 0.34.8 are unable to detect and punish a new...

Command Execution Vulnerability in Patrol Cloud Light Forum System (CNVD-2022-01416)

Cruise cloud light forum system contains forums, Q&A module, using JAVA MYSQL architecture. A command execution vulnerability exists in the Patrol Cloud Light Forum system, which can be exploited by an attacker to gain server control privileges...

What is JSON-RPC ❓ Definition, Work, Comparison

Just like everything else, the world of API protocols is evolving. Typical SOAP and REST APIs have many companies like GraphQL, gRPC, and Thrift. JSON-RPC is also on the list. Created to develop feature-rich and quick websites, it is developers’ best buddy. Let us see what it is and how it benefi...

CVE-2011-4119

caml-light = 0.75 uses mktemp insecurely, and also does unsafe things in /tmp during make install...

Code injection

caml-light = 0.75 uses mktemp insecurely, and also does unsafe things in /tmp during make install...

CVE-2011-4119

CVE-2011-4119 affects caml-light

Caml-light 安全漏洞

Caml-Light is an older, open source lightweight implementation of the core Caml language from the Caml team. Caml-light suffers from a security vulnerability that stems from Caml-light = 0.75 using mktemp insecurely and doing unsafe things in TMP during make install...

CVE-2021-24684

The WordPress PDF Light Viewer Plugin WordPress plugin before 1.4.12 allows users with Author roles to execute arbitrary OS command on the server via OS Command Injection when invoking Ghostscript...

CVE-2021-24684

The WordPress PDF Light Viewer Plugin WordPress plugin before 1.4.12 allows users with Author roles to execute arbitrary OS command on the server via OS Command Injection when invoking Ghostscript...

CVE-2021-24684

The CVE applies to the WordPress PDF Light Viewer Plugin for WordPress, affected in versions prior to 1.4.12. The root cause is an OS Command Injection via Ghostscript, exploitable by users with Author roles, enabling arbitrary command execution on the server. Impact is high (remote execution, se...

WordPress 插件 操作系统命令注入漏洞

WordPress plugin is a WordPress open source application plugin . WordPress PDF Light Viewer plugin version 1.4.12 before the existence of operating system command injection vulnerability, an attacker can exploit the vulnerability in the call Ghostscript through the OS command injection on the...

PDF Light Viewer < 1.4.12 - Authenticated Command Injection

The plugin allows users with Author roles to execute arbitrary OS command on the server via OS Command Injection when invoking Ghostscript. 1 Go to Import PDF. 2 Select PDF file. 3 Set compression as 60 | calc | echo 4 Toggle import the first checkbox 5 Publish or update 6 Command executes...

PDF Light Viewer < 1.4.12 - Authenticated Command Injection

The plugin allows users with Author roles to execute arbitrary OS command on the server via OS Command Injection when invoking Ghostscript. PoC 1 Go to Import PDF. 2 Select PDF file. 3 Set compression as 60 | calc | echo 4 Toggle import the first checkbox 5 Publish or update 6 Command executes...

WordPress PDF Light Viewer plugin <= 1.4.11 - Authenticated Command Injection vulnerability

Authenticated Command Injection vulnerability discovered by apple502j in WordPress PDF Light Viewer plugin versions = 1.4.11. Solution Update the WordPress PDF Light Viewer plugin to the latest available version at least 1.4.12...

CVE-2021-24535

The Light Messages WordPress plugin through 1.0 is lacking CSRF check when updating it's settings, and is not sanitising its Message Content in them even with the unfilteredhtml disallowed. As a result, an attacker could make a logged in admin update the settings to arbitrary values, and set a...

CVE-2021-24535 Light Messages <= 1.0 - CSRF to Stored XSS

The Light Messages WordPress plugin through 1.0 is lacking CSRF check when updating it's settings, and is not sanitising its Message Content in them even with the unfilteredhtml disallowed. As a result, an attacker could make a logged in admin update the settings to arbitrary values, and set a...