CVE-2022-22470

CVE-2022-22470 affects IBM Security Verify Governance 10.0, where credentials are stored in plain clear text and readable by a local user due to insecure storage. The Red Hat/IBM IBM bulletin confirms the issue with a CVSS base score around 4.1 (C:H, I:N, A:N) and local access as the attack vecto...

Upgraded Q -> M from #172 [1673039408650]

Judge has assessed an item in Issue 172 as M risk. The relevant finding follows: L-02 --- The text was updated successfully, but these errors were encountered: All reactions...

CVE-2022-47091

GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer Overflow in gftextprocesssub function of filters/loadtext.c...

GPAC MP4Box 安全漏洞

GPAC MP4Box is multimedia packager. It is mainly used to work with ISOBMF files e.g. MP4, 3GP, but can also be used to import/export media from container files such as AVI, MPG, MKV, MPEG-2 TS, etc. A security vulnerability exists in GPAC MP4Box version 2.1-DEV-rev574-g9d5bb184b, which stems from...

Vim has a binary vulnerability (CNVD-2023-09647)

Vim is a cross-platform text editor. A security vulnerability exists in versions of Vim prior to 9.0.1144, which stems from a heap memory overflow in the function msgputsprintf, and can be exploited by an attacker to trigger a denial of service and potentially run code...

Binary vulnerability in vim (CNVD-2023-09648)

Vim is a cross-platform text editor. A security vulnerability exists in Vim that originates from an out-of-bounds memory read in the function buildstlstrhl, which can be exploited by an attacker to trigger a denial of service and potentially run code...

Binary vulnerability in vim (CNVD-2023-09166)

Vim is a cross-platform text editor. A security vulnerability exists in Vim that originates from an out-of-bounds memory write in the function dostringsub, which can be exploited by an attacker to trigger a denial of service and potentially run code...

Security Bulletin: IBM Content Navigator is affected by Apache Commons Text due to IBM Content Manager onDemand connector [CVE-2022-42889]

Summary Apache Commons Text is used by IBM Content Navigator on container as part of the IBM Content Manager onDemand connector. CVE-2022-42889 The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2022-42889 DESCRIPTION: Apache Commons Text could allow a remote attacker to execut...

Mozilla Firefox Resource Management Error Vulnerability (CNVD-2023-03063)

Mozilla Firefox, an open source Web browser from the Mozilla Foundation, is vulnerable to a resource management error that results from improper internal resource management when selecting text. A remote attacker could use the vulnerability to trick a victim into selecting certain portions of tex...

Cross-site Scripting (XSS)

github.com/usememos/memos is vulnerable to stored cross-site scripting attacks. The library does not check for XSS payloads in the text of a new post, allowing an attacker to inject and execute malicious javascript...

[SECURITY] Fedora 37 Update: emacs-28.2-1.fc37

Emacs is a powerful, customizable, self-documenting, modeless text editor. Emacs contains special code editing features, a scripting language elisp, and the capability to read mail, news, and more without leaving the editor. This package provides an emacs binary with support for X windows...

CVE-2022-4099 Joy Of Text Lite < 2.3.1 - Unauthenticated SQLi

The Joy Of Text Lite WordPress plugin before 2.3.1 does not properly sanitise and escape some parameters before using them in SQL statements accessible to unauthenticated users, leading to unauthenticated SQL injection...

CVE-2022-4099 Joy Of Text Lite < 2.3.1 - Unauthenticated SQLi

The Joy Of Text Lite WordPress plugin before 2.3.1 does not properly sanitise and escape some parameters before using them in SQL statements accessible to unauthenticated users, leading to unauthenticated SQL injection...

PT-2023-13913 · WordPress · The Joy Of Text Lite

Name of the Vulnerable Software and Affected Versions: The Joy Of Text Lite WordPress plugin versions prior to 2.3.1 Description: The issue arises from the plugin's failure to properly sanitise and escape certain parameters before using them in SQL statements, which are accessible to...

WordPress plugin Joy Of Text Lite SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in the...

[SECURITY] Fedora 37 Update: w3m-0.5.3-58.git20220429.fc37

The w3m program is a pager or text file viewer that can also be used as a text-mode Web browser. W3m features include the following: when reading an HTML document, you can follow links and view images using an external image viewer; its internet message mode determines the type of document from t...

[SECURITY] Fedora 36 Update: w3m-0.5.3-58.git20220429.fc36

The w3m program is a pager or text file viewer that can also be used as a text-mode Web browser. W3m features include the following: when reading an HTML document, you can follow links and view images using an external image viewer; its internet message mode determines the type of document from t...

Grafana -- Stored XSS in text panel plugin

Grafana Labs reports: During an internal audit of Grafana on January 1, a member of the security team found a stored XSS vulnerability affecting the core text plugin. The stored XSS vulnerability requires several user interactions in order to be fully exploited. The vulnerability was possible due...

Security Bulletin: IBM Synthetic Playback Agent is vulnerable due to its use of Apache Commons Text [CVE-2022-42889]

Summary Synthetic Playback Agent version 8.1.4 IF17 has addressed the following vulnerability: CVE-2022-42889 Vulnerability Details CVEID:CVE-2022-42889 DESCRIPTION: Apache Commons Text could allow a remote attacker to execute arbitrary code on the system, caused by an insecure interpolation...

Optimize images ALT Text (alt tag) & names for SEO using AI < 2.0.8 - Settings Update via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Use the following form to abuse the CSRF vulnerability on the settings page: action layout textColor contentBackgroundColor starColor...