458 matches found
CVE-2023-51497
Missing Authorization vulnerability in Woo WooCommerce Ship to Multiple Addresses.This issue affects WooCommerce Ship to Multiple Addresses: from n/a through 3.8.9...
CVE-2024-31359
Missing Authorization vulnerability in Premmerce Premmerce Product Filter for WooCommerce.This issue affects Premmerce Product Filter for WooCommerce: from n/a through 3.7.2...
CVE-2024-36389
MileSight DeviceHub - CWE-330 Use of Insufficiently Random Values may allow Authentication Bypass...
Inadequate XSS Prevention in CodeIgniter/Framework Security Library
The xssclean method in the Security Library of CodeIgniter/Framework, specifically in versions before 3.0.3, exhibited a vulnerability that allowed certain Cross-Site Scripting XSS vectors to bypass its intended protection mechanisms. The xssclean method is designed to sanitize input data by...
GHSA-Q9J3-4GHJ-6H57 Inadequate XSS Prevention in CodeIgniter/Framework Security Library
The xssclean method in the Security Library of CodeIgniter/Framework, specifically in versions before 3.0.3, exhibited a vulnerability that allowed certain Cross-Site Scripting XSS vectors to bypass its intended protection mechanisms. The xssclean method is designed to sanitize input data by...
Mbed TLS 安全漏洞
Mbed TLS is an open source, portable, easy to use, readable and flexible SSL library. A security vulnerability exists in Mbed TLS versions prior to 3.6.0, which stems from the fact that if TLS 1.2 is disabled at build time, a TLS 1.2 client may cause a denial of service by placing a server that...
USN-6708-1 graphviz vulnerability
It was discovered that Graphviz incorrectly handled certain config6a files. An attacker could possibly use this issue to cause a denial of service...
[SECURITY] Fedora 40 Update: prometheus-simpleclient-java-0.12.0-11.fc40
Prometheus instrumentation library for JVM applications...
USN-6676-1 c-ares vulnerability
Vojtěch Vobr discovered that c-ares incorrectly handled user input from local configuration files. An attacker could possibly use this issue to cause a denial of service via application crash...
OESA-2024-1220 jss security update
JSS offers a implementation for java-based applications to use native NSS. Security Fixes: A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the...
CVE-2023-52381
Script injection vulnerability in the email module.Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability...
GnuTLS Security Vulnerabilities
GnuTLS is a free secure communications library for implementing the SSL, TLS and DTLS protocols. A security vulnerability exists in GnuTLS, which stems from a difference in response time for ciphertexts that are formatted incorrectly versus ciphertexts that are correctly padded, which could allow...
CLSA-2023-1703612912 openssh: Fix of CVE-2023-51385
CVE-2023-51385: ban user/hostnames with most shell metacharacters in command line...
CVE-2023-36004
Windows DPAPI Data Protection Application Programming Interface Spoofing Vulnerability...
PT-2023-7891 · Sap · Sap Btp Security Services Integration Library +1
Name of the Vulnerable Software and Affected Versions: SAP BTP Security Services Integration Library Python sap-xssec versions = 4.1.0 It is recommended to upgrade to the latest released version to ensure the issue is fully resolved. No workarounds are available for this issue...
Validation of SignedInfo
Validation of an XML Signature requires verification that the hash value of the related XML-document after any optional transformations and/or normalizations matches a specific DigestValue-value, but also that the cryptografic signature on the SignedInfo-tree the one that contains the DigestValue...
CVE-2023-42529
Out-of-bound write vulnerability in libsec-ril prior to SMR Nov-2023 Release 1 allows local attackers to execute arbitrary code...
com.github.wmixvideo:nfe (>=3.1.40 <=4.0.41), com.github.zuinnote:hadoopoffice-flinkts_2.11 (=1.7.0) +239 more potentially affected by CVE-2023-44483 via org.apache.santuario:xmlsec (>=3.0.0 <=3.0.2)
org.apache.santuario:xmlsec MAVEN version =3.0.0, =3.1.40, =2022.5.1, =2022.5.1, =2022.5.1, =2022.5.1, =2022.5.1, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.4.0 and more Source cves: CVE-2023-44483 Source advisory: OSV:GHSA-XFRJ-6VVC-3XM2...
AZL-31303 CVE-2023-45142 affecting package cri-tools for versions less than 1.29.0-2
OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.useragent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP...