csaf_distribution 跨站脚本漏洞

csafdistribution is csaf-poc open source set of csaf tools. csafdistribution csafprovider versions prior to 0.8.2 has a security vulnerability , the vulnerability stems from its allows an attacker to achieve cross-site scripting through a well-crafted CSAF document uploaded as text/html...

CVE-2022-43996

The csafprovider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as text/html. The endpoint upload allows valid CSAF advisories JSON format to be uploaded with Content-Type text/html and filenames ending in .html. When subsequently accessed via web browser, these advisories a...

CLSA-2022-1670874574 vim: Fix of 2 CVEs

CVE-2022-4141: check for text locked in CTRL-W gf - CVE-2022-3520: check that the column does not become negative...

vim: Fix of 2 CVEs

CVE-2022-4141: check for text locked in CTRL-W gf - CVE-2022-3520: check that the column does not become negative...

CLSA-2022-1670874212 vim: Fix of 2 CVEs

CVE-2022-4141: check for text locked in CTRL-W gf - CVE-2022-3520: check that the column does not become negative...

Mask Webhook secret Key

While configuring webhooks in bitbucket, we have the option to provide a secret key that is not masked, and hence the plain text secret key is visible in audit logs, kindly mask the secret key Steps to reproduce Configure webhook in Bitbucket server When the hook is created,modified we see the...

USN-5772-1 qemu vulnerabilities

It was discovered that QEMU incorrectly handled bulk transfers from SPICE clients. A remote attacker could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. CVE-2021-3682 It...

kadunapark.com.au Cross Site Scripting vulnerability OBB-3095683

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2022-6298 · Apeks-Vuz · Apeks-Vuz

Name of the Vulnerable Software and Affected Versions: Apeks-VUZ system affected versions not specified Description: The issue is related to the storage of passwords in plain text in the system settings table of the Apeks database in the Apeks-VUZ education automation system. This could allow a...

WordPress plugin Donation Button 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in WordPress plugin...

ARC Informatique PcVue 安全漏洞

ARC Informatique PcVue is a multifunctional HMI-SCADA software from ARC Informatique, France, an all-in-one solution that monitors all aspects of a customer's assets.PcVue is used in a wide range of applications such as industrial control, building management, energy management, smart grids, ener...

CVE-2022-25629

An authenticated user who has the privilege to add/edit annotations on the Content tab, can craft a malicious annotation that can be executed on the annotations page Annotation Text Column...

UBUNTU-CVE-2022-23484

xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol RDP. xrdp v0.9.21 contain a Integer Overflow in xrdpmmprocessrailupdatewindowtext function. There are no known workarounds for this issue. Users are advised to upgrade...

[SECURITY] Fedora 35 Update: ruby-3.0.5-155.fc35

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible...

xrdp 输入验证错误漏洞

xrdp is an open source remote desktop protocol server from Neutrinolabs Labs. An input validation error vulnerability exists in versions prior to xrdp v0.9.21, which stems from the inclusion of an integer overflow in the xrdpmmprocessrailupdatewindowtext function...

Amazon Linux 2022 : gcc (ALAS2022-2022-222)

The version of gcc installed on the remote host is prior to 11.3.1-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-222 advisory. - An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering...

Vulnerabilities fixed in VMware vCenter and ESXi

VMWare has fixed several vulnerabilities in vCenter Server and ESXi. A malicious party could exploit the vulnerabilities to cause a denial-of-service, to gain access to sensitive data, including cleat-text passwords and, under certain circumstances to break out of the sandbox of a guest environme...

The vulnerability in the implementation of PreparedStatement.setText() or PreparedStatement.setBytea() methods of the JDBC driver (PgJDBC) for connecting Java programs to PostgreSQL allows a hacker to exploit the protected information.

The vulnerability in the implementation of PreparedStatement.setText or PreparedStatement.setBytea methods of the PgJDBC driver for connecting Java programs to PostgreSQL lies in the use of insecure temporary files. Exploiting this vulnerability could allow an attacker to disclose sensitive...

Phishing Scams: How To Recognize A Scam Email, VOIP call, or Text

By Owais Sultan A phishing scam is not only about stealing your login credentials, but it can also install malware, including ransomware, which is why it is essential to learn how to tackle this growing threat. This is a post from HackRead.com Read the original post: Phishing Scams: How To...

CVE-2022-45877

OpenHarmony-v3.1.4 and prior versions had an vulnerability. PIN code is transmitted to the peer device in plain text during cross-device authentication, which reduces the difficulty of man-in-the-middle attacks...