SUSE CVE-2022-27382

MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component Itemfield::usedtables/updatedependmapfororder...

SUSE CVE-2022-45693

Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted string...

CVE-2022-45436: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cross-Site Scripting XSS. As a manager privilege user , create a network map containing name as xss payload. Once created, admin user must clic...

CVE-2023-25733

The return value from gfx::SourceSurfaceSkia::Map wasn't being verified which could have potentially lead to a null pointer dereference. This vulnerability affects Firefox 110...

PT-2023-14665 · Artica · Artica Pandora Fms

Name of the Vulnerable Software and Affected Versions: Artica PFMS Pandora FMS version v765 Description: The issue allows Cross-Site Scripting XSS due to improper neutralization of input during web page generation. As a manager privilege user, an attacker can create a network map containing a...

CVE-2022-45436

Pandora FMS/Artica PFMS v765 is affected by a vulnerability described as improper neutralization of input during web page generation (XSS) in the network maps editor. A manager-privilege attacker can create a network map whose name contains an XSS payload; when an admin user later edits network m...

CVE-2023-22939

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘map’ search processing language SPL command lets a search bypass SPL safeguards for risky commands. The vulnerability requires a higher privileged user to initiate a request within their browser and only affects instances with...

CVE-2023-22939

The CVE-2023-22939 vulnerability affects Splunk Enterprise versions prior to 8.1.13, 8.2.10, and 9.0.4. It involves the map SPL command that lets a search bypass safeguards for risky commands, requiring a higher-privileged user to initiate a request from a user’s browser and only impacting instan...

CVE-2023-24524

SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to delete the data with a high impact to availability...

CVE-2023-24524

CVE-2023-24524 affects SAP S/4HANA Map Treasury Correspondence Format Data. The accompanying documents describe an missing authorization check for authenticated users, enabling privilege escalation and potential data deletion with high availability impact. The core issue is an authorization gap i...

PT-2023-4439

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 110 Description The issue is related to the gfx::SourceSurfaceSkia::Map function, where the return value was not being verified, potentially leading to a null pointer dereference. This could allow a remote attacker to...

PT-2023-18782 · Splunk · Splunk Enterprise

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 8.1.13 Splunk Enterprise versions prior to 8.2.10 Splunk Enterprise versions prior to 9.0.4 Description: The issue allows a search to bypass safeguards for risky commands using the map search processing...

CVE-2023-24524: Missing Authorization

SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to delete the data with a high impact to availability...

CVE-2023-22939: Improper Input Validation

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘map’ search processing language SPL command lets a search bypass SPL safeguards for risky commands. The vulnerability requires a higher privileged user to initiate a request within their browser and only affects instances with...

WordPress Interactive SVG Image Map Builder Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Interactive SVG Image Map Builder Type Plugin Vulnerable versions = 1.0 Fixed in 1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25704 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9e6397036265 Credits Lokesh...

Interactive SVG Image Map Builder < 1.1 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

SAP S/4 HANA security vulnerabilities

SAP S/4 HANA is an intelligent, integrated ERP software for large enterprises from SAP, Germany. A security vulnerability exists in SAP S/4 HANA Map Treasury Correspondence Format Data, which stems from a lack of authorization checks for users. An attacker could exploit the vulnerability to eleva...

GSD-2023-1002230 misc: fastrpc: Don't remove map on creater_process and device_release

misc: fastrpc: Don't remove map on createrprocess and devicerelease This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.230 by commit...

GSD-2023-1002173 misc: fastrpc: Don't remove map on creater_process and device_release

misc: fastrpc: Don't remove map on createrprocess and devicerelease This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.165 by commit...

GSD-2023-1001971 misc: fastrpc: Don't remove map on creater_process and device_release

misc: fastrpc: Don't remove map on createrprocess and devicerelease This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.8 by commit...