279 matches found
WordPress Products Suggestions for WooCommerce Plugin <= 3.5.7.6 is vulnerable to Broken Access Control
Software Products Suggestions for WooCommerce Type Plugin Vulnerable versions = 3.5.7.6 Fixed in 3.5.7.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-45813 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 2035a8efcc94 Credits Istv...
SUSE CVE-2016-1625
The Chrome Instant feature in Google Chrome before 48.0.2564.109 does not ensure that a New Tab Page NTP navigation target is on the most-visited or suggestions list, which allows remote attackers to bypass intended restrictions via unspecified vectors, related to instantservice.cc and...
SUSE CVE-2019-17018
When in Private Browsing Mode on Windows 10, the Windows keyboard may retain word suggestions to improve the accuracy of the keyboard. This vulnerability affects Firefox 72...
CVE-2023-23925 Switcher Client contains Regular Expression Denial of Service (ReDoS)
Switcher Client is a JavaScript SDK to work with Switcher API which is cloud-based Feature Flag. Unsanitized input flows into Strategy match operation EXIST, where it is used to build a regular expression. This may result in a Regular expression Denial of Service attack reDOS. This issue has been...
USER CAN BLOCK GOVERNANCE VOTING BY SUBMITTING MULTIPLE PROPOSALS
Lines of code Vulnerability details Impact A user can submit multiple proposals and then endorse each one of them to be able to activate them, and because the Governance contract allow only one active proposal, this user will be able to always activate his proposals and thus not allowing any othe...
Velocidex Velociraptor 跨站脚本漏洞
Velocidex Velociraptor is a tool from Velocidex Australia that uses Velociraptor Query Language VQL queries to collect host-based status information. A security vulnerability exists in Velocidex Velociraptor versions prior to 0.6.5-2, which stems from the editor suggestion feature in the...
PT-2022-22934 · Unknown · Velociraptor
Name of the Vulnerable Software and Affected Versions: Velociraptor versions prior to 0.6.5-2 Description: The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact. This field was not properly sanitized and can lead to...
Syncro Soft Oxygen XML WebHelp 跨站脚本漏洞
Syncro Soft Oxygen XML WebHelp is used by Syncro Soft Romania to convert DITA and DocBook resources to WebHelp output. A security vulnerability exists in Syncro Soft Oxygen XML WebHelp versions prior to 22.1 build 2021082006, 23.x prior to 23.1 build 2021090310, which stems from an XSS...
Denial Of Service (DoS)
vim is vulnerable to denial of service. The vulnerability exists due to the usage of invalid index when looking for spell suggestions which causes out-of-bound reads which then lead to an application crash...
first user can steal everyone else's tokens
Lines of code Vulnerability details Impact Detailed description of the impact of this finding. A user who joins the systems first stakes first can steal everybody's tokens by sending tokens to the system externally. This attack is possible because you enable staking a small amount of tokens. Proo...
Metasploit Weekly Wrap-Up
Ask and you may receive Module suggestions for the win, this week we see a new module written by jheysel-r7 based on CVE-2022-26352 that happens to have been suggested by jvoisin in the issue queue last month. This module targets an arbitrary file upload in dotCMS versions before 22.03, 5.3.8.10,...
USN-5458-1: Vim vulnerabilities
It was discovered that Vim was incorrectly handling virtual column position operations, which could result in an out-of-bounds read. An attacker could possibly use this issue to expose sensitive information. CVE-2021-4193 It was discovered that Vim was not properly performing bounds checks when...
Improper Neutralization of Input During Web Page Generation in Jenkins
jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in search suggestions due to improperly escaping users with less-than and greater-than characters in their names SECURITY-388...
GHSA-JFF5-55XJ-4JCQ Improper Neutralization of Input During Web Page Generation in Jenkins
jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in search suggestions due to improperly escaping users with less-than and greater-than characters in their names SECURITY-388...
GHSA-V222-W2MW-XJC6 Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions SECURITY-385. The autocomplete feature on the search box discloses the names of the views in its suggestions, including the ones for which the current user does not have access to...
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions SECURITY-385. The autocomplete feature on the search box discloses the names of the views in its suggestions, including the ones for which the current user does not have access to...
PT-2022-3577 · Npm · Npm-Dependency-Versions
Name of the Vulnerable Software and Affected Versions: npm-dependency-versions versions 0.3.0 and earlier Description: The issue is related to insufficient argument checking in the npm-dependency-versions package, which can lead to command injection. An attacker can exploit this by calling...
CVE-2022-27920
libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0...
