CVE-2023-27534 affecting package curl for versions less than 8.0.1-1

CVE-2023-27534 affecting package curl for versions less than 8.0.1-1. An upgraded version of the package is available that resolves this issue...

Calibre-Web 安全漏洞

Calibre-Web is a web application for browsing, reading and downloading eBooks from the Calibre database. A security vulnerability exists in Calibre-Web versions prior to 0.6.20, which stems from an improper restriction on excessive authentication attempts...

K000133409: Log4j vulnerability CVE-2023-26464

Security Advisory Description UNSUPPORTED WHEN ASSIGNED When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted ie, deeply nested hashmap or hashtable depending on which logging...

SUSE CVE-2023-24824

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads...

Uptime Kuma 跨站脚本漏洞

Uptime Kuma is an easy-to-use self-hosted monitoring tool from Louis Lam Personal Developer. A cross-site scripting vulnerability exists in Uptime Kuma version v.1.19.6 and earlier. An attacker can exploit this vulnerability to execute arbitrary commands via the description, title, footer, and...

PT-2023-17181 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore/pimcore versions prior to 10.5.20 Description: This issue is related to Cross-site Scripting XSS - Reflected, which has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cook...

Delta Electronics InfraSuite Device Master 安全漏洞

Delta Electronics InfraSuite Device Master is Delta Electronics' device for simplifying and automating critical equipment monitoring. An authentication error vulnerability exists in Delta Electronics InfraSuite Device Master versions prior to 1.0.5, which can be exploited by an attacker to genera...

CVE-2023-1127 affecting package vim for versions less than 9.0.1402-1

CVE-2023-1127 affecting package vim for versions less than 9.0.1402-1. An upgraded version of the package is available that resolves this issue...

PT-2023-21573 · Etcd +1 · Etcd +1

Name of the Vulnerable Software and Affected Versions: cilium-cli versions prior to 0.13.2 Description: The issue arises when cilium-cli is used to configure cluster mesh functionality, potentially removing the enforcement of user permissions on the etcd store. This occurs due to an incorrect mou...

Galaxy 安全漏洞

Galaxy is an open source platform for FAIR data analysis open-sourced by the Galaxy Project. A security vulnerability exists in Galaxy versions 22.01, 22.05, and all versions prior to 23.0, which stems from the ability to modify a page/visualization without authorization due to insufficient...

CVE-2023-26464

UNSUPPORTED WHEN ASSIGNED When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted ie, deeply nested hashmap or hashtable depending on which logging component is in use to be processed...

CVE-2023-26464 Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender

UNSUPPORTED WHEN ASSIGNED When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted ie, deeply nested hashmap or hashtable depending on which logging component is in use to be processed...

CVE-2023-0567 affecting package php for versions less than 8.1.16-1

CVE-2023-0567 affecting package php for versions less than 8.1.16-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-0802 affecting package libtiff for versions less than 4.4.0-8

CVE-2023-0802 affecting package libtiff for versions less than 4.4.0-8. A patched version of the package is available...

CVE-2022-46392 affecting package fluent-bit for versions less than 2.0.9-1

CVE-2022-46392 affecting package fluent-bit for versions less than 2.0.9-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-20052 affecting package clamav for versions less than 0.105.2-1

CVE-2023-20052 affecting package clamav for versions less than 0.105.2-1. An upgraded version of the package is available that resolves this issue...

bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip...

CVE-2022-31144 affecting package redis for versions less than 6.2.9-1

CVE-2022-31144 affecting package redis for versions less than 6.2.9-1. This CVE either no longer is or was never applicable...

CVE-2023-22972

A Reflected Cross-site scripting XSS vulnerability in interface/forms/eyemag/php/eyemagfunctions.php in OpenEMR 7.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the REQUESTURI...

CVE-2023-0419 Shortcode for Font Awesome < 1.4.1 - Contributor+ Stored XSS

The Shortcode for Font Awesome WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...