Jenkins Filesystem Trigger Plugin XML External Entity Expansion (CVE-2021-21659)

An XML external entity expansion vulnerability exists in Jenkins Filesystem Trigger Plugin. Successful exploitation of this vulnerability could result in the disclosure of file contents from the target system...

Apache Airflow Cross-Site Scripting Vulnerability (CNVD-2022-74073)

Apache Airflow is a community-created platform for programmatically authoring, scheduling, and monitoring workflows. a cross-site scripting vulnerability exists in versions of Apache Airflow prior to 2.4.2. The vulnerability is related to the affected version not properly filtering user input. Th...

GitLab 操作系统命令注入漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. GitLab Runner suffers from an operating system command injection vulnerability...

Fancier Author Box by ThematoSoup <= 1.4 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Open the setting page of this plugin. 2. There...

reCAPTCHA <= 1.6 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. On the setting page of this plugin, enter the...

Apache Airflow Cross-site Scripting vulnerability

In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the origin query argument...

GHSA-H63R-9XXF-F2C7 Apache Airflow Cross-site Scripting vulnerability

In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the origin query argument...

PYSEC-2022-42970

In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the origin query argument...

PYSEC-2022-42970

In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the origin query argument...

PT-2022-27052 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.4.2 Description: The issue concerns an XSS attack via the origin query argument in the "Trigger DAG with config" screen. Recommendations: For versions prior to 2.4.2, update to version 2.4.2 or later to...

CVE-2022-43982 Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL

In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the origin query argument...

CVE-2022-43982: Improper Neutralization of Input During Web Page Generation

In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the origin query argument...

CVE-2022-43982

In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the "origin" query argument...

PT-2022-24232

Name of the Vulnerable Software and Affected Versions Axiomatic Bento4 affected versions not specified Description A problematic issue was found in Axiomatic Bento4, affecting the mp4decrypt component, which leads to a memory leak. The issue can be initiated remotely. Recommendations At the momen...

Popup Maker < 1.16.11 - Contributor+ Stored Cross Site Scripting

The plugin does not sanitise and escape some of its Popup options, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks, which could be used against admins Create a New popup Insert pop-up name, title, and body text. Add a new trigger with defau...

Evaluate <= 1.0 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example, in multisite setup. 1. Go to Settings » Evaluate » Add New. 2. Add...

OpenBMC 缓冲区错误漏洞

OpenBMC is a Linux distribution for managing controllers used in devices such as servers, top-of-rack switches or RAID devices. It uses Yocto, OpenEmbedded, systemd and D-Bus to easily customize your platform. A security vulnerability exists in OpenBMC Project bmcweb, which stems from the fact th...

CVE-2022-35261

A denial of service vulnerability exists in the webserver hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the...

SUSE-SU-2022:3729-1 Security update for bind

This update for bind fixes the following issues: - CVE-2022-2795: Fixed potential performance degredation due to missing database lookup limits when processing large delegations bsc1203614. - CVE-2022-38177: Fixed a memory leak that could be externally triggered in the DNSSEC verification code fo...

PT-2022-38101

Уязвимость функции iio sysfs trigger remove модуля drivers/iio/trigger/iio-trig-sysfs.c драйвера различных типов встроенных датчиков ядра операционной системы Linux связана с неправильным освобождением памяти. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...