PT-2022-24267 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.0 through 15.3.4 GitLab CE/EE versions 15.4 through 15.4.3 GitLab CE/EE versions 15.5 through 15.5.1 Description: An improper authorization issue in GitLab CE/EE allows malicious users to set emojis on internal notes...

PT-2022-27388 · Tenda · Tenda Ax12

Name of the Vulnerable Software and Affected Versions: Tenda AX12 version V22.03.01.16 cn Description: The issue is related to command injection via the goform/fast setting internet set API endpoint. This allows for potential malicious commands to be executed. Recommendations: For Tenda AX12...

Fancier Author Box by ThematoSoup <= 1.4 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Open the setting page of this plugin. 2. There...

Fancier Author Box by ThematoSoup <= 1.4 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Open the setting page of this plugin. 2...

Find and Replace All < 1.3 - Reflected Cross Site Scripting

The plugin does not sanitize and escape some parameters from its setting page before outputting them back to the user, leading to a Reflected Cross-Site Scripting issue. PoC...

PT-2022-24144 · Unknown · Pdf & Print Plugin

Name of the Vulnerable Software and Affected Versions: PDF & Print Plugin affected versions not specified Description: A vulnerability was found in the PDF & Print Plugin, affecting an unknown part of the component Setting Handler. The issue leads to cross-site scripting and can be initiated...

November 1, 2022, update for Office 2016 (KB5002306)

None None...

PT-2022-24190 · Unknown · Webfactory Under Construction Plugin

Name of the Vulnerable Software and Affected Versions: WebFactory Under Construction Plugin affected versions not specified Description: A problematic vulnerability has been found in the WebFactory Under Construction Plugin, affecting the Plugin Setting Handler component. This issue leads to...

SUSE-SU-2022:3750-1 Security update for SUSE Manager Server 4.3

This update fixes the following issues: cobbler: - Consider case of 'nextserver' being a hostname during migration of Cobbler collections. - Fix problem with 'proxyurlext' setting being None type. - Fix settings migration schema to work while upgrading on existing running Uyuni and SUSE Manager...

[VPN Plugin] Transfer Login keeps Loading with Non-English language setting

In Citrix Gateway VPN environment, you may observe the following issue when "Transfer Login": After clicking "Transfer" on Client VPN plugin, the button keepsspinning loading and stuck. Logs investigation show the following clues: Problem can only be observed in Non-English language setting Plugi...

Tenda AC15 缓冲区错误漏洞

The Tenda AC15 is a wireless router from the Chinese company Tenda. The Tenda AC15 suffers from a buffer overflow vulnerability that originates from the timeZone parameter of the formfastsettingwifiset function that lacks length validation for input data. An attacker could exploit the vulnerabili...

CVE-2022-43259

Tenda AC15 V15.03.05.18 was discovered to contain a stack overflow via the timeZone parameter in the formfastsettingwifiset function...

CVE-2022-3547

A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /csms/admin/?page=systeminfo of the component Setting Handler. The manipulation of the argument System Name/System Short Name lead...

CVE-2022-3547

A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /csms/admin/?page=systeminfo of the component Setting Handler. The manipulation of the argument System Name/System Short Name lead...

Cross site scripting

A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /csms/admin/?page=systeminfo of the component Setting Handler. The manipulation of the argument System Name/System Short Name lead...

CVE-2022-3547: Improper Neutralization

A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /csms/admin/?page=systeminfo of the component Setting Handler. The manipulation of the argument System Name/System Short Name lead...

PT-2022-22845 · Sourcecodester · Sourcecodester Simple Cold Storage Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Cold Storage Management System version 1.0 Description: A problem was found in the Setting Handler component, specifically affecting the /csms/admin/?page=system info file. The issue arises from the manipulation of the...

PicUploader 跨站脚本漏洞

PicUploader is a graphic bed tool written in php by Bruce's personal developer. It helps you to quickly upload your images to a cloud image bed and automatically return Markdown-formatted links to the clipboard. A security vulnerability exists in PicUploader version v2.6.3, which stems from a...

PT-2022-25873 · Unknown · Picuploader

Name of the Vulnerable Software and Affected Versions: PicUploader version 2.6.3 Description: A cross-site scripting XSS issue was found in the setStorageParams function within SettingController.php. Recommendations: For PicUploader version 2.6.3, update the SettingController.php file to fix the...

Tenda AC18 fast_setting_wifi_set stack overflow vulnerability

The Tenda AC18 is a router from the Chinese company Tenda. Tenda AC18 V15.03.05.19 suffers from a stack overflow vulnerability, which stems from the fastsettingwifiset function not performing a size check on incoming data, and can be exploited by an attacker to cause remote code execution or deni...