[SECURITY] Fedora 36 Update: osmo-0.4.4-2.fc36

Osmo is a handy personal organizer which includes calendar, tasks manager and address book modules. It was designed to be a small, easy to use and good looking PIM tool to help to manage personal information. In current state the organizer is quite convenient in use - for example, user can perfor...

VR Calendar < 2.3.1 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting PoC https://example.com/wp-admin/plugins.php?vrcmsg=msgtype="...

CVE-2022-36318

When visiting directory listings for chrome:// URLs as source text, some parameters were reflected. This vulnerability affects Firefox ESR 102.1, Firefox ESR 91.12, Firefox 103, Thunderbird 102.1, and Thunderbird 91.12...

Mozilla Firefox Security Advisory (MFSA2022-28) - Linux

The remote host is missing an update for Mozilla Firefox, announced via the advisory MFSA2022-28. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...

CVE-2022-34991

Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting XSS vulnerabilities via the firstname and lastname parameters...

AZL-35367 CVE-2021-33457 affecting package yasm 1.3.0-17

An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expandmmacparams in modules/preprocs/nasm/nasm-pp.c...

Cross site scripting

Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting XSS vulnerabilities via the firstname and lastname parameters...

Cross-site Scripting (XSS)

fava is vulnerable to cross-site scripting. The vulnerability exists because of the lack of escaping error messages in errors.html, allowing an attacker to inject and execute malicious javascript through the malicious verbatim parameters...

Cross-site Scripting (XSS)

fava is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in the querystring parameters of Query.svelte, allowing an attacker to inject and execute malicious javascript...

Fava time and filter parameters vulnerable to reflected Cross-site Scripting

The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected cross-site scripting due to the lack of escaping of error messages which contained the parameters in verbatim...

GHSA-PC62-CQ5X-3J5G node-import `params` argument can be controlled by users without any sanitization

This affects all versions of package node-import. The params argument of module function can be controlled by users without any sanitization. This is then provided to the “eval” function located in line 79 in the index file index.js...

Techvillage Paymoney 跨站脚本漏洞

Techvillage Paymoney is a secure online payment gateway from Techvillage Bangladesh. A security vulnerability exists in Techvillage Paymoney v3.3, which stems from a security issue with the parameters firstname and lastname in Users, which can be exploited by an attacker to hijack an XSRF-Token...

H3C Magic R200 Buffer Overflow Vulnerability (CNVD-2022-54323)

H3C Magic R200 is a wireless router device. H3C Magic R200 doping.asp has a buffer overflow vulnerability in the handling of INTF parameters, which can be exploited by remote attackers to submit special requests that can crash the service program or execute arbitrary code in the application conte...

PYSEC-2022-43182

Withdrawn as duplicate of PYSEC-2022-239. The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim...

UBUNTU-CVE-2022-2514

The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim...

CVE-2022-2514

The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim...

WordPress plugin WP Video Lightbox 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress plugin Unyson 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress plugin Name Directory 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in the WordPress plugin...

Homepage Product Organizer for WooCommerce <= 1.1 - Subscriber+ SQLi

The plugin does not properly sanitise and escape some parameters before using them in SQL statements, leading to SQL injection exploitable by any authenticated users such as subscriber...