6956 matches found
kernel: Race between task migrating pages and another task calling exit_mmap to release those same pages getting invalid opcode BUG in include/linux/swapops.h
A flaw was found in pfnswapentrytopage in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause a denial of service problem due to a BUG statement referencing pmdt x...
WordPress Interactive World Map Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)
Software Interactive World Map Type Plugin Vulnerable versions = 3.2.0 Fixed in 3.4.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-47767 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 246d6d2a2061 Credits Le Ngoc Anh...
CVE-2023-47223
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP Map Plugins Basic Interactive World Map plugin = 2.0 versions...
CVE-2023-47223
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP Map Plugins Basic Interactive World Map plugin = 2.0 versions...
CVE-2023-47223
A vulnerability in WP Map Plugins Basic Interactive World Map basic-interactive-world-map.This issue affects Basic Interactive World Map: from n/a through = 2.0...
Cross site scripting
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP Map Plugins Basic Interactive World Map plugin = 2.0 versions...
CVE-2023-47223 WordPress Basic Interactive World Map Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP Map Plugins Basic Interactive World Map plugin = 2.0 versions...
CVE-2023-47223
CVE-2023-47223 affects the WordPress plugin Basic Interactive World Map (WP Map Plugins) version ≤ 2.0. The vulnerability is a stored XSS due to inadequate escaping of input in the affected component, with an attacker (admin+ privileges) able to trigger it. The issue is classified with low to med...
CVE-2023-47223 WordPress Basic Interactive World Map Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP Map Plugins Basic Interactive World Map plugin = 2.0 versions...
WordPress Plugin Basic Interactive World Map Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...
kernel: bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILE
A flaw was found in the bpftool distributed by the Linux kernel. A NULL pointer dereference can be triggered when bpftool is used to pin PROG, MAP, LINK without FILE due to a missing validation. This issue can result in a denial of service...
kernel: missing mmap_lock in file_files_note that could possibly lead to a use after free in the coredump code
A use-after-free flaw was found in the Linux kernel’s core dump subsystem. This flaw allows a local user to crash the system. Only if patch 390031c94211 "coredump: Use the vma snapshot in fillfilesnote" not applied yet, then kernel could be affected...
kernel: drm/gud: Fix UBSAN warning
A flaw was found in the GUD Generic USB Display driver in the Linux kernel. Uninitialized iosysmap variables on the stack contain garbage values in their isiomem boolean field. When iosysmapclear checks this field, UBSAN flags it as an invalid boolean value, indicating potential undefined behavio...
kernel: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Don't let sockmapclose,destroy,unhash call itself sockmap proto callbacks should never call themselves by design. Protect against bugs like 1 and break out of the recursive loop to avoid a stack overflow in favor of...
grafana: persistent xss in grafana core plugins
A flaw was found in The GeoMap and Canvas plugins of Grafana. The GeoMap and Canvas plugins are core plugins in Grafana, which means that all Grafana instances have GeoMap and Canvas installed. These two plugins are vulnerable to Cross-site scripting, where an attacker with an Editor role can add...
WordPress CBX Map for Google Map & OpenStreetMap Plugin <= 1.1.11 is vulnerable to Cross Site Scripting (XSS)
Software CBX Map for Google Map & OpenStreetMap Type Plugin Vulnerable versions = 1.1.11 Fixed in 1.1.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-47240 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 37695d80e832 Credit...
WordPress Basic Interactive World Map Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)
Software Basic Interactive World Map Type Plugin Vulnerable versions = 2.0 Fixed in 2.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-47223 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 49944254b130 Credits DoYeon Park p6rkdoye0n Require...
jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin
A flaw was found in the script-security Jenkins Plugin. In affected versions of the script-security plugin, property assignments performed implicitly by the Groovy language runtime when invoking map constructors were not intercepted by the sandbox. This vulnerability allows attackers with...
jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin
A flaw was found in the script-security Jenkins Plugin. In affected versions of the script-security plugin, property assignments performed implicitly by the Groovy language runtime when invoking map constructors were not intercepted by the sandbox. This vulnerability allows attackers with...
GLSA-202310-16 : Ubiquiti UniFi: remote code execution via bundled log4j
The remote host is affected by the vulnerability described in GLSA-202310-16 Ubiquiti UniFi: remote code execution via bundled log4j - JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provid...