13092 matches found
Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget
Stored cross-site scripting XSS vulnerability in the Wiki widget in Liferay Wiki Web before 7.0.95 from Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88...
Buffer Overflow
libzephyr.so is vulnerable to Buffer Overflow. The vulnerability exists in wifiargstoparams function at wifishell.c which allows an attacker to cause an application crash...
CVE-2023-45655 WordPress PixFields Plugin <= 0.7.0 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in PixelGrade PixFields plugin = 0.7.0 versions...
Allocation of Resources Without Limits or Throttling
OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.useragent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP...
CVE-2023-5586 NULL Pointer Dereference in gpac/gpac
NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3.0-DEV...
OSV-2023-1012 Global-buffer-overflow in iusace_quantize_lines
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63230 Crash type: Global-buffer-overflow READ 4 Crash state: iusacequantizelines iusacequantizespec iusacefdencode...
GHSA-H3G9-CWR6-HPHX Magento Open Source allows SQL Injection
Adobe Commerce versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier and 2.4.4-p5 and earlier are affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could lead in arbitrary code execution by an admin-privileg...
DLA-3616-1 org-mode - security update
Bulletin has no description...
CVE-2023-45510
tsMuxer version git-2539d07 was discovered to contain an alloc-dealloc-mismatch operator new vs operator delete error...
CVE-2023-5487
Inappropriate implementation in Fullscreen in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. Chromium security severity: Medium...
BELL-CVE-2023-39325
Bulletin has no description...
BELL-CVE-2023-38545
Bulletin has no description...
CVE-2023-4990
Directory traversal vulnerability in MCL-Net versions prior to 4.6 Update Package P01 may allow attackers to read arbitrary files...
CVE-2023-44995
Cross-Site Request Forgery CSRF vulnerability in WP Doctor WooCommerce Login Redirect plugin = 2.2.4 versions...
BELL-CVE-2023-39192
Bulletin has no description...
Arbitrary File Upload
Gradio is vulnerable to an Arbitrary File Upload vulnerability. The vulnerability is due to the /upload interface endpoint via /tmp directory. The attacker can exploit this by uploading arbitrary files, potentially leading to unauthorized access or execution of malicious code...
DLA-3611-1 inetutils - security update
Bulletin has no description...
BELL-CVE-2023-45322
Bulletin has no description...