17026 matches found
GHSA-PFWC-4FRF-4GF8 Cross-site scripting in Liferay Portal
Cross-site scripting XSS vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment's UR...
apache-commons-text: variable interpolation RCE
A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code...
User session not correctly destroyed on logout
None...
[SECURITY] Fedora 38 Update: dokuwiki-20230404a-1.fc38
DokuWiki is a standards compliant, simple to use Wiki, mainly aimed at creati ng documentation of any kind. It has a simple but powerful syntax which makes su re the data-files remain readable outside the Wiki and eases the creation of structured texts. All data is stored in plain text files no...
poppler security update
20.11.0-6 - Check for overflow when computing number of symbols - in JBIG2 text region - Resolves: 2126361...
Ultimate Dashboard < 3.7.6 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Go to "Ultimate Dashboard - Settings - General"...
CVE-2022-4945
The Dataprobe cloud usernames and passwords are stored in plain text in a specific file. Any user able to read this specific file from the device could compromise other devices connected to the user's cloud...
Design/Logic Flaw
The Dataprobe cloud usernames and passwords are stored in plain text in a specific file. Any user able to read this specific file from the device could compromise other devices connected to the user's cloud...
CVE-2022-4945 CVE-2022-4945
The Dataprobe cloud usernames and passwords are stored in plain text in a specific file. Any user able to read this specific file from the device could compromise other devices connected to the user's cloud...
CVE-2022-4945 CVE-2022-4945
The Dataprobe cloud usernames and passwords are stored in plain text in a specific file. Any user able to read this specific file from the device could compromise other devices connected to the user's cloud...
CVE-2022-4945
Dataprobe iBoot-PDU FW prior to 1.43.03312023 stores cloud usernames and passwords in plaintext in a specific file. An attacker who can read that file could compromise other devices linked to the user’s cloud. Affected product: iBoot-PDU (Dataprobe). Root cause: plaintext credential storage. Impa...
KeePass Exploit Allows Attackers to Recover Master Passwords from Memory
A proof-of-concept PoC has been made available for a security flaw impacting the KeePass password manager that could be exploited to recover a victim's master password in cleartext under specific circumstances. The issue, tracked as CVE-2023-32784, impacts KeePass versions 2.x for Windows, Linux,...
Export feature adds clear text password to the directories configuration on the zip file - Import fails with "Can't decrypt data"
h3. Problem When exporting a Bamboo configuration, the resulting zip file will contain clear-text passwords on db-export/directories.xml. This introduces a security issue and a broken import with the following error: code:java 2023-05-22 15:18:52,590 INFO main SecretEncryptionServiceImpl Can't...
AI ChatBot < 4.5.5 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitize and escape its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. 1. Go to plugin settings under "WPBot Lite Simple Text Responses" 2. Enter the payload Test Query"...
Dataprobe iBoot-PDU 安全漏洞
The Dataprobe iBoot-PDU is a web-accessible managed PDU independently controlled outlet from Dataprobe USA. A security vulnerability exists in versions prior to Dataprobe iBoot-PDU FW 1.42.06162022. A security vulnerability exists, which stems from a cloud username and password being stored in...
PT-2023-15931 · Dataprobe · Dataprobe Cloud
Name of the Vulnerable Software and Affected Versions: Dataprobe cloud affected versions not specified Description: The Dataprobe cloud stores usernames and passwords in plain text in a specific file. Any user able to read this file from the device could compromise other devices connected to the...
PT-2023-3988 · Unknown · Sumatrapdf
Name of the Vulnerable Software and Affected Versions: SumatraPDF version 3.4.6 Description: The issue is related to a buffer overflow in the SumatraPDF Reader when handling text files, such as first.txt and second.txt, due to the lack of size checking of input data. This can be exploited by a...
MGASA-2023-0176 Updated glib2.0 packages fix security vulnerability
Denial of service caused by handling a malicious text-form variant. CVE-2023-24593 Denial of service caused by malicious serialised variant. CVE-2023-25180...
