Security feature bypass

An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security...

Basecamp: Spam & Clearance checks disabled with existing referenced Message-ID

A vulnerability in the inbound email processing allowed crafted emails to bypass spam filtering and The Screener when they appeared to be in reply to an existing thread...

AZL-26943 CVE-2023-33285 affecting package qt5-qtbase for versions less than 5.12.11-9

An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. QDnsLookup has a buffer over-read via a crafted reply from a DNS server...

Cross-Site Scripting (XSS)

concrete5/concrete5 is vulnerable to Cross-Site Scripting XSS. The vulnerability exists in the reply form due to the lack of sanitization in msgID, which allows an attacker to inject and execute arbitrary JavaScript into the browser...

kernel: RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix duplicated reported IWCMEVENTCONNECTREPLY event If siwrecvmparr returns -EAGAIN, it means that the MPA reply hasn't been received completely, and should not report IWCMEVENTCONNECTREPLY in this case. This may trigge...

kernel: RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix duplicated reported IWCMEVENTCONNECTREPLY event If siwrecvmparr returns -EAGAIN, it means that the MPA reply hasn't been received completely, and should not report IWCMEVENTCONNECTREPLY in this case. This may trigge...

PT-2025-26062 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved, related to the RDMA/siw component. The issue occurs when the siw recv mpa rr function returns -EAGAIN, indicating that the MPA...

GHSA-VCPR-HM2M-GJJJ Reflected cross site scripting

Concrete CMS previously concrete5 before 9.2 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized...

Reflected cross site scripting

Concrete CMS previously concrete5 before 9.2 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized...

CVE-2023-28475

Concrete CMS previously concrete5 versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized...

Cross site scripting

Concrete CMS previously concrete5 versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized...

CVE-2023-28475

Concrete CMS previously concrete5 versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized...

CVE-2023-28475

Concrete CMS (formerly concrete5) is affected by a Reflected XSS in the Reply form due to msgID not being sanitized. Affected versions: 8.5.12 and earlier, and 9.0–9.1.3. Impact per sources: potential to inject/execute arbitrary script in the browser. Remediation: upgrade to 9.2+ (patch versions ...

PT-2023-21745 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS previously concrete5 versions 8.5.12 and below Concrete CMS previously concrete5 versions 9.0 through 9.1.3 Description: The issue is related to Reflected XSS on the Reply form because the msgID was not sanitized. This allows for...

CVE-2022-25091

Infopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside private forums to be disclosed by unauthenticated users via the quote reply feature...

WordPress Comment Reply Notification Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Comment Reply Notification Type Plugin Vulnerable versions = 1.4 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25051 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fac19e90ec15 Credits Mika Require...

K48281956: NFSv2/3 kernel vulnerability CVE-2017-7645

Security Advisory Description The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers to cause a denial of service system crash via a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c. CVE-2017-7645 Impact There i...

SUSE CVE-2005-0108

Apache modauthradius 1.5.4 and libpam-radius-auth allow remote malicious RADIUS servers to cause a denial of service crash via a RADIUSREPLYMESSAGE with a RADIUS attribute length of 1, which leads to a memcpy operation with a -1 length argument...

SUSE CVE-2005-0469

Buffer overflow in the slcaddreply function in various BSD-based Telnet clients, when handling LINEMODE suboptions, allows remote attackers to execute arbitrary code via a reply with a large number of Set Local Character SLC commands...

SUSE CVE-2005-0667

Buffer overflow in Sylpheed before 1.0.3 and other versions before 1.9.5 allows remote attackers to execute arbitrary code via an e-mail message with certain headers containing non-ASCII characters that are not properly handled when the user replies to the message...