WordPress Plugin WP-Filebase Download Manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Plugin WP-Filebase Download Manager version 3.4.4 contains a cross-site scripting...

CVE-2021-40510

XML eXternal Entity XXE in OBDA systems’ Mastro 1.0 allows remote attackers to read system files via custom DTDs...

CVE-2022-20733

A vulnerability in the login page of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to log in without credentials and access all roles without any restrictions. This vulnerability is due to exposed sensitive Security Assertion Markup Language SAML metadata. An...

Cisco Identity Services Engine Authentication Bypass Vulnerability

A vulnerability in the login page of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to log in without credentials and access all roles without any restrictions. This vulnerability is due to exposed sensitive Security Assertion Markup Language SAML metadata. An...

CVE-2022-32285

A vulnerability has been identified in Mendix SAML Module Mendix 7 compatible All versions V1.16.6, Mendix SAML Module Mendix 8 compatible All versions V2.2.2, Mendix SAML Module Mendix 9 compatible All versions V3.2.3. The affected module is vulnerable to XML External Entity XXE attacks due to...

The vulnerability of Cisco Expressway microprogramming software and Cisco TelePresence Video Communication Server microprogramming software management devices is related to incorrect restrictions on XML references to external objects. This allows attackers to view the content of any file on the server or perform network scanning on the internal and external infrastructure.

The vulnerability of Cisco Expressway microprogramming software and Cisco TelePresence Video Communication Server microprogramming software related to external objects’ XML links is due to incorrect restrictions on these links. Exploiting this vulnerability allows a malicious actor to view the...

PT-2022-18882 · Sap · Sap Netweaver

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver EP Web Page Composer affected versions not specified Description: The issue arises from insufficient validation of an XML document accepted from an untrusted source. This allows an adversary to exploit unprotected XML parking at...

PT-2022-14123 · WordPress · Export Any Wordpress Data To Xml/Csv

Name of the Vulnerable Software and Affected Versions: Export any WordPress data to XML/CSV WordPress plugin versions prior to 1.3.5 Description: The issue arises from the lack of sanitization of the cpt POST parameter when exporting post data, which is then used in a database query. This leads t...

The vulnerability of the Microsoft Silverlight software platform, related to insufficient checking of pointers, allows a perpetrator to execute arbitrary code or gain access to read, modify, or delete data.

The vulnerability of the Microsoft Silverlight software platform lies in the insufficient checking of pointers used to access elements when processing HTML objects. Exploiting this vulnerability allows an attacker to execute arbitrary code or gain access to read, modify, or delete data by running...

Drupal 信任管理问题漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A trust management issue vulnerability exists in Drupal SAML SP version 2.0. An attacker exploits the vulnerability to log in as any selected user...

CVE-2022-1542

The HPB Dashboard WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

The vulnerability of the PJSIP multimedia communication library, related to executing a loop with an unavailable exit condition, allows attackers to cause service failures.

The vulnerability of the PJSIP multimedia communication library is related to the execution of a loop with an unavailable exit condition during syntactic analysis of XML files. Exploiting this vulnerability can allow a malicious actor to cause service failures...

PT-2022-11716 · Mini-Xml · Mini-Xml

Name of the Vulnerable Software and Affected Versions: Mini-XML version 3.2 Description: A stack buffer overflow exists in Mini-XML. When inputting an unformed XML string to the "mxmlLoadString" API, it will cause a stack-buffer-overflow in mxml string getc. Note that it is unclear whether this...

GHSA-XQPP-26PP-2365 XSS vulnerability in Jenkins Markdown Formatter Plugin

Jenkins Markdown Formatter Plugin 0.1.0 and earlier uses a Markdown library to parse Markdown that does not escape crafted link target URLs. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with the ability to edit any description rendered using the...

Reflected XSS vulnerability in Jenkins markup formatter preview

Jenkins allows administrators to choose the markup formatter to use for descriptions of jobs, builds, views, etc. displayed in Jenkins. When editing such a description, users can choose to have Jenkins render a formatted preview of the description they entered. Jenkins 2.274 and earlier, LTS...

GHSA-7QF3-C2Q8-69M3 Reflected XSS vulnerability in Jenkins markup formatter preview

Jenkins allows administrators to choose the markup formatter to use for descriptions of jobs, builds, views, etc. displayed in Jenkins. When editing such a description, users can choose to have Jenkins render a formatted preview of the description they entered. Jenkins 2.274 and earlier, LTS...

Stored XSS vulnerability in Jenkins Active Choices Plugin

Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission. Active Choices Plugin 2.5 escapes the name of build parameters and...

GHSA-WJ5W-QGHH-GVQP Mattermost Server does not neutralize HTML content in an Email template field

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized...

Stored XSS vulnerability in Jenkins Compact Columns Plugin

Compact Columns Plugin 1.11 and earlier displays the unprocessed job description in tooltips. This results in a stored cross-site scripting vulnerability that can be exploited by users with Job/Configure permission. Compact Columns Plugin 1.12 applies the configured markup formatter to the job...

Remote code execution in Microsoft.WindowsDesktop.App.Ref

A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework Remote Code Execution Vulnerability'...