4713 matches found
DRUPAL-CORE-2022-012
In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However,...
When setSubnodeOwner transfers ownership of sub-domain the new owner can perform actions before fuses are burned
Lines of code Vulnerability details Impact Function NameWrapper.setSubnodeOwner can be used to transfer ownership of a sub-domain to a new owner and, at the same time, burn fuses. A possible use-case could be that a domain owner wants to transfer ownership of the sub-domain but burn fuses in orde...
DEBIAN-CVE-2021-33656
When setting font with malicous data by ioctl cmd PIOFONT,kernel will write memory out of bounds...
CVE-2021-33656
When setting font with malicous data by ioctl cmd PIOFONT,kernel will write memory out of bounds...
Out-of-bounds
When setting font with malicous data by ioctl cmd PIOFONT,kernel will write memory out of bounds...
Apache Spark Unauthenticated Command Injection RCE
This module exploits an unauthenticated command injection vulnerability in Apache Spark. Successful exploitation results in remote code execution under the context of the Spark application user. The command injection occurs because Spark checks the group membership of the user passed in the ?doAs...
CVE-2022-22452
IBM Security Verify Identity Manager 10.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 224918...
CVE-2021-46741
The basic framework and setting module have defects, which were introduced during the design. Successful exploitation of this vulnerability may affect system integrity...
CVE-2021-46741
The basic framework and setting module have defects, which were introduced during the design. Successful exploitation of this vulnerability may affect system integrity...
CVE-2021-46741
The basic framework and setting module have defects, which were introduced during the design. Successful exploitation of this vulnerability may affect system integrity...
CVE-2021-46741
The basic framework and setting module have defects, which were introduced during the design. Successful exploitation of this vulnerability may affect system integrity...
CVE-2022-2092
The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.16.0 doesn't escape a parameter on its setting page, making it possible for attackers to conduct reflected cross-site scripting attacks...
CVE-2022-2050
The WP-Paginate WordPress plugin before 2.1.9 does not escape one of its settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when unfilteredhtml is disallowed...
CVE-2022-2050
The WP-Paginate WordPress plugin before 2.1.9 does not escape one of its settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when unfilteredhtml is disallowed...
PT-2022-12912 · Huawei · Emui +2
Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue is related to defects in the basic framework and setting module, which were introduced during the design phase. Successful exploitation of this issue may impact system...
CVE-2022-2092: Improper Neutralization of Input During Web Page Generation
The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.16.0 doesn't escape a parameter on its setting page, making it possible for attackers to conduct reflected cross-site scripting attacks...
PT-2022-14852
Name of the Vulnerable Software and Affected Versions WooCommerce PDF Invoices & Packing Slips versions prior to 2.16.0 Description The issue allows attackers to conduct reflected cross-site scripting attacks due to a parameter on the setting page not being properly escaped. This makes it possibl...
Tenda AX1803 WanParameterSetting function command injection vulnerability
Tenda AX1803 is a dual-band gigabit WIFI6 router from Tenda China.Tenda AX1803 v1.0.0.12890 version of the command injection vulnerability, which stems from the WanParameterSetting function fails to properly filter the construct command special characters, commands, etc.. An attacker could exploi...