61 matches found
CVE-2025-45607
An issue in the component /manage/ of itranswarp v2.19 allows attackers to bypass authentication via a crafted request...
iTranswarp 安全漏洞
iTranswarp is a full-featured CMS by Crypto Michael Individual Developers. A security vulnerability exists in iTranswarp version v2.19, which stems from improper component/manage/authentication and could lead to bypassing authentication...
CVE-2025-25205
Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers can craft URLs containing substrings lik...
PT-2024-16595 · Wpdevart · Wpdevart Booking Calendar
Name of the Vulnerable Software and Affected Versions: Booking Calendar WpDevArt plugin versions up to, and including, 3.2.19 Description: The issue is a time-based, blind SQL injection vulnerability via the id parameter in the "wpdevart booking calendar" shortcode. This vulnerability is due to...
Exploit for CVE-2024-54160
CVE-2024-54160-Opensearch-HTML-Injection + Stored XSS It w...
PT-2024-32381 · Unknown · Computer Vision Annotation Tool
Name of the Vulnerable Software and Affected Versions: Computer Vision Annotation Tool CVAT versions prior to 2.19.0 Description: The Computer Vision Annotation Tool CVAT is an interactive video and image annotation tool for computer vision. A malicious CVAT user with permissions to create or edi...
SUSE CVE-2022-43705
In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 November 2016...
PT-2023-7904 · WordPress · User Post Gallery
Name of the Vulnerable Software and Affected Versions: User Post Gallery WordPress plugin versions 2.19 and earlier Description: The issue is related to insufficient authorization procedure in the User Post Gallery WordPress plugin, allowing remote attackers to execute arbitrary code. This is...
DEBIAN-CVE-2022-23514
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a...
DEBIAN-CVE-2022-23516
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah = 2.2.0, 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception. This may lead to a...
UBUNTU-CVE-2022-23516
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah = 2.2.0, 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception. This may lead to a...
GeoServer 代码问题漏洞
GeoServer is an open source software server written in Java. It allows users to share and edit geospatial data. A security vulnerability exists in GeoServer that originates from an option that allows SSRF to set up proxy hosts through. The following products and versions are affected: versions...
Spring Expression DoS Vulnerability
In Spring Framework versions 5.3.0 - 5.3.16, 5.2.0 - 5.2.19, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition...
PT-2020-15533 · Jenkins · Jenkins Active Directory Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Active Directory Plugin versions 2.19 and earlier Description: A cross-site request forgery CSRF issue allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers...
CVE-2020-8952
Fiserv Accurate Reconciliation 2.19.0, fixed in 3.0.0 or higher, allows XSS via the logout.jsp timeOut parameter...
CloudBees Jenkins Stored Cross-Site Scripting Vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...
camel: Directory traversal in file producer
Apache Camel's File is vulnerable to directory traversal. Camel 2.21.0 to 2.21.3, 2.22.0 to 2.22.2, 2.23.0 and the unsupported Camel 2.x 2.19 and earlier versions may be also affected...
Compatibility update for upgrading to Windows 10, version 1809: April 2, 2019
None None...
BigTree cross-site scripting vulnerability (CNVD-2018-03229)
Fastspot BigTree is the United States Fastspot company based on PHP and MySQL open source content management system CMS. A cross-site scripting vulnerability exists in the core/admin/ajax/developer/extensions/file-browser.php file in version 4.2.19 of Fastspot BigTree. A remote attacker can explo...