16043 matches found
CVE-2022-36583
DedeCMS V5.7.97 was discovered to contain multiple cross-site scripting XSS vulnerabilities at /dede/codo.php via the dopost, rpok, and aid parameters...
Cross site scripting
DedeCMS V5.7.97 was discovered to contain multiple cross-site scripting XSS vulnerabilities at /dede/codo.php via the dopost, rpok, and aid parameters...
Word Search Puzzles game <= 2.0.1 - Contributor+ Stored XSS
The plugin does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...
Realtek Linux/Android Bluetooth Mesh SDK 安全漏洞
Realtek Linux/Android Bluetooth Mesh SDK is a Bluetooth mesh networking software development kit from Realtek Semiconductor China. A security vulnerability exists in previous versions of the Realtek Linux/Android Bluetooth Mesh SDK v4.18-4.18-20220218, which stems from an insufficient validation ...
Moderate: openssl security and bug fix update
OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: crehash script allows command injection CVE-2022-1292 openssl: Signer certificate verification...
ALSA-2022:6224 Moderate: openssl security and bug fix update
OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: crehash script allows command injection CVE-2022-1292 openssl: Signer certificate verification...
CVE-2022-2559
The Fluent Support WordPress plugin before 1.5.8 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection vulnerability exploitable by high privilege users...
CVE-2022-2537
The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 3.0.1 does not sanitise and escape some parameters before outputting them back in an attributes of an admin page, leading to Reflected Cross-Site Scripting...
CVE-2022-2559
The Fluent Support WordPress plugin before 1.5.8 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection vulnerability exploitable by high privilege users...
CVE-2022-1123
The Leaflet Maps Marker Google Maps, OpenStreetMap, Bing Maps WordPress plugin before 3.12.5 does not properly sanitize some parameters before inserting them into SQL queries. As a result, high privilege users could perform SQL injection attacks...
CVE-2022-1123
The Leaflet Maps Marker Google Maps, OpenStreetMap, Bing Maps WordPress plugin before 3.12.5 does not properly sanitize some parameters before inserting them into SQL queries. As a result, high privilege users could perform SQL injection attacks...
PT-2022-17247 · WordPress · Woocommerce Pdf Invoices & Packing Slips
Name of the Vulnerable Software and Affected Versions: WooCommerce PDF Invoices & Packing Slips WordPress plugin versions prior to 3.0.1 Description: The issue is related to Reflected Cross-Site Scripting. It occurs because some parameters are not properly sanitised and escaped before being...
The vulnerability of the pg_queryParams() function in the PHP programming language allows a hacker to execute arbitrary code.
The vulnerability of the pgqueryParams function in the PHP programming language is related to the misuse of an uninitialized array. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Dynamic quorum votes parameters for a proposal (Proposal A) are changed according to another proposal (Proposal B) that proposes to update dynamic quorum votes parameters when Proposal B is executed after Proposal A is created in the same block
Lines of code Vulnerability details Impact The following writeQuorumParamsCheckpoint function is used to record dynamic quorum votes parameters at a block of interest. function writeQuorumParamsCheckpointDynamicQuorumParams memory params internal uint32 blockNumber = safe32block.number, 'block...
ONLY ADMIN IS ABLE TO CHANGE THE VOTING PARAMETERS
Lines of code Vulnerability details Impact In both the NounsDAOLogicV1 and NounsDAOLogicV2 contracts, only admin is able to change the voting parameters which includes : VotingDelay VotingPeriod ProposalThresholdBPS MinQuorumVotesBPS MaxQuorumVotesBPS QuorumCoefficient This will ma...
NounsDAOLogicV2's state() and proposals() will use initial dynamic params for all V1 proposals
Lines of code Vulnerability details state and proposals call quorumVotesid that utilize initial dynamic params for all V1 proposals by misusing 0 as a proposal creation block. I.e. new field is referenced while it is zero for all V1 proposals. This way all V1 proposals will use the same initial s...
Ubuntu: Security Advisory (USN-2028-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Updated thunderbird packages fix security vulnerability
Mouse Position spoofing with CSS transforms. CVE-2022-36319 Directory indexes for bundled resources reflected URL parameters. CVE-2022-36318...