Jenkins Plugin Rich Text Publisher 跨站脚本漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. The vulnerability stems from not escaping HTML messages set by its post-build...

Malicious code in dtv-rich-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 811bde282f3e7423ea7566e09f3e9f90748e2c254489e834e3c618ebbe9d8942 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2601 Malicious code in dtv-rich-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 811bde282f3e7423ea7566e09f3e9f90748e2c254489e834e3c618ebbe9d8942 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

June 14, 2022-KB5013887 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10, version 20H2, Windows Server, version 20H2, Windows 10 Version 21H1, and Windows 10 Version 21H2

None None...

PT-2022-20487 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 9.5.34 ELTS TYPO3 versions prior to 10.4.29 TYPO3 versions prior to 11.5.11 Description: The issue concerns user-submitted content not being properly encoded in HTML emails sent to users. The affected components are ma...

Microsoft Office zero-day “Follina”—it’s not a bug, it’s a feature! (It’s a bug)

Update: Please see our FAQ for the latest guidance and mitigation tips on Follina. On Monday May 30, 2022, Microsoft issued CVE-2022-30190 regarding the Microsoft Support Diagnostic Tool MSDT in Windows vulnerability. The mitigation offered by Microsoft consists of an alternative method to...

Zero-day vulnerability discovered in Microsoft Word

A researcher has found a zero-day vulnerability in Microsoft Word. This new exploit in Office macros, external template files containing malicious code while macros are disabled. When a user converts the document to RTF format, the code is also executed in "Protected view" or "Preview mode. For...

ferris-rich-input (0.0.1) potentially affected by CVE-2020-27193 via ckeditor4 (4.14.0)

ckeditor4 NPM version 4.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on ckeditor4 and may be impacted: - ferris-rich-input 0.0.1 Source cves: CVE-2020-27193 Source advisory: OSV:GHSA-4M44-5J2G-XF64...

GHSA-RF66-HMQF-Q3FC Improper Neutralization of Input During Web Page Generation in Select2

In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in directus

Impact Unauthorized JavaScript can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script tag. This satisfies the regular content security policy header, which in turn allows the file to run an...

CVE-2022-24814 Cross-site Scripting in Directus

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript JS can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script ta...

The vulnerability of the Rich Text Editor component in the Oracle PeopleSoft Enterprise PeopleTools business application package allows a perpetrator to gain access to data and compromise its integrity.

The vulnerability of the Rich Text Editor component in the Oracle PeopleSoft Enterprise PeopleTools business application suite exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to data and compromise its...

ferris-rich-input (0.0.1) potentially affected by CVE-2022-24728 +1 more via ckeditor4 (4.14.0)

ckeditor4 NPM version 4.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on ckeditor4 and may be impacted: - ferris-rich-input 0.0.1 Source cves: CVE-2022-24728, CVE-2022-24729 Source advisory: OSV:GHSA-4FC4-4P5G-6W89...

CVE-2022-23609

iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize user input used to remove files leading to file deletion only limited by the process permissions. Users are advised to upgrade as soon as possible...

Command injection

iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize image file paths leading to OS level command injection. This issue has been patched in commit cdcd48b. Users are advised to upgrade...

CVE-2022-23609

CVE-2022-23609 affects iTunesRPC-Remastered, a Windows Discord Rich Presence utility. Multiple sources describe a path traversal vulnerability where improper sanitization of user input enables file deletion, constrained only by process permissions. Connected Red Hat, CNVD/CNNVD, OSV, CVE records ...

CVE-2022-23611 OS command injection in iTunesRPC-Remastered

iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize image file paths leading to OS level command injection. This issue has been patched in commit cdcd48b. Users are advised to upgrade...

CVE-2022-23611

Summary (CVE-2022-23611): The issue affects iTunesRPC-Remastered, a Windows Discord Rich Presence utility for iTunes. It states that certain versions did not properly sanitize image file paths, causing an OS-level command injection vulnerability. The vulnerability is described as being fixed in c...

CVE-2022-23611 OS command injection in iTunesRPC-Remastered

iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize image file paths leading to OS level command injection. This issue has been patched in commit cdcd48b. Users are advised to upgrade...

Code injection

iTunesRPC-Remastered is a discord rich presence application for use with iTunes & Apple Music. In code before commit 24f43aa user input is not properly sanitized and code injection is possible. Users are advised to upgrade as soon as is possible. There are no known workarounds for this issue...