CVE-2024-6651

The WordPress File Upload WordPress plugin before 4.24.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

haproxy: untrimmed URI fragments may lead to exposure of confidential data on static servers

HAProxy before 2.8.2 accepts as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a pathend rule, such as routing index.html.png to a static server...

Fedora: Security Advisory (FEDORA-2024-a702b78744)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OpenHarmony 安全漏洞

OpenHarmony is a kind of Hongmeng operating system open source project of China OpenAtom Foundation OpenAtom Foundation Foundation. A security vulnerability exists in OpenHarmony prior to version v3.2.4. A remote attacker could exploit the vulnerability to bypass privilege authentication to insta...

util-linux 安全漏洞

util-linux is an open source software package. A security vulnerability exists in util-linux version 2.40 and earlier, which stems from the fact that wall is typically installed with the setgid tty permission, which allows escape sequences to be sent to other users' terminals via argv, which coul...

PT-2024-20749 · Unknown · Maspik – Spam Blacklist

Name of the Vulnerable Software and Affected Versions: Maspik – Spam Blacklist versions 0.10.6 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject...

AZL-39220 CVE-2023-45237 affecting package edk2 for versions less than 20230301gitf80f052277c8-40

EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality...

CVE-2022-2413

The Slide Anything WordPress plugin before 2.3.47 does not properly sanitize or escape the slide title before outputting it in the admin pages, allowing a logged in user with roles as low as Author to inject a javascript payload into the slide title even when the unfilteredhtml capability is...

aiohttp Security Vulnerabilities

aiohttp is an open source asynchronous HTTP client/server framework for asyncio and Python. A security vulnerability exists in aiohttp versions prior to 3.9.0, which stems from incorrect authentication that allows an attacker to modify an HTTP request or create a new HTTP request while the attack...

WordPress Plugin PayGreen - Ancienne version Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin PayGreen - Ancienne versio...

PT-2023-8446

Name of the Vulnerable Software and Affected Versions jsrsasign versions prior to 11.0.0 Description The issue is related to an Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process in the jsrsasign package. An attacker can decrypt ciphertexts by exploiting this flaw, which is...

AZL-31611 CVE-2023-45802 affecting package httpd for versions less than 2.4.58-1

When a HTTP/2 stream was reset RST frame by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing...

Progress Software WS_FTP Server Security Vulnerability

Progress Software WSFTP Server is an effective and highly manageable FTP server from Progress Software, USA. A security vulnerability exists in Progress Software WSFTP Server versions prior to 8.8.2. An attacker can use this vulnerability to enumerate files in the "WebServiceHost" directory listi...

PT-2023-20604 · Oppo · Oppo Find X3 +1

Name of the Vulnerable Software and Affected Versions: mobile phone backup app affected versions not specified Description: There is a command injection problem in the old version of the mobile phone backup app. Recommendations: At the moment, there is no information about a newer version that...

tar: heap buffer overflow at from_header() in list.c via specially crafted checksum

A flaw was found in the Tar package. When attempting to read files with old V7 tar format with a specially crafted checksum, an invalid memory read may occur. An attacker could possibly use this issue to expose sensitive information or cause a crash...

SUSE CVE-2017-3312

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Packaging. Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure...

SUSE CVE-2019-0223

While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 C library and its language bindings can connect to a peer anonymously using TLS even when configured to verify the peer certificate while used with OpenSSL versions before...

Suspicious login app ships old league/flysystem version

None...

[SECURITY] Fedora 35 Update: python3.7-3.7.14-1.fc35

Python 3.7 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.7, see other distributions that support it, such as an older Fedora release...

PT-2022-4018 · Compuware +1 · Jenkins Compuware Ispw Operations Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Compuware ISPW Operations Plugin versions 1.0.8 and earlier Description: The issue is related to the Jenkins Compuware ISPW Operations Plugin, which does not restrict the execution of a controller/agent message to agents. This allows...