Stored Cross-Site Scripting (XSS)

phpmyfaq is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of santization in the getUserData parameter of header.php which allows an attacker to inject and execute arbitrary JavaScript into the system through the username field...

PT-2023-19404

Name of the Vulnerable Software and Affected Versions MvcTools version 6d48cd6830fc1df1d8c9d61caa1805fd6a1b7737 Description The issue allows attackers to access sensitive user information and execute arbitrary code via a code execution backdoor in the request package, as specified in...

Mitsubishi Electric GX Works3 Information Disclosure

The vulnerability of the software for programming Mitsubishi Electric GX Works3 relates to the possibility of using strictly encrypted user data. Exploiting this vulnerability can allow a malicious actor to obtain information about project files for security modules via the MELSEC protocol...

WordPress plugin ShopLentor: code-related vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

User data in TPM attestation vulnerable to MITM

Impact Attestation user data such as the digest of the public key in an aTLS connection was bound to the issuer's TPM, but not to its PCR state. An attacker could intercept a node initialization, initialize the node themselves, and then impersonate an uninitialized node to the validator. In...

SUSE CVE-2009-4298

The LAMS module mod/lams for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores the 1 username, 2 firstname, and 3 lastname fields within the user table, which allows attackers to obtain user account information via unknown vectors...

SUSE CVE-2015-5179

FreeIPA might display user data improperly via vectors involving non-printable characters...

SUSE CVE-2017-8439

Kibana version 5.4.0 was affected by a Cross Site Scripting XSS bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive information from Kibana users...

SUSE CVE-2017-1000395

Jenkins 2.73.1 and earlier, 2.83 and earlier provides information about Jenkins user accounts which is generally available to anyone with Overall/Read permissions via the /user/username/api remote API. This included e.g. Jenkins users' email addresses if the Mailer Plugin is installed. The remote...

SUSE CVE-2019-0221

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a...

SUSE CVE-2021-28374

The Debian courier-authlib package before 0.71.1-2 for Courier Authentication Library creates a /run/courier/authdaemon directory with weak permissions, allowing an attacker to read user information. This may include a cleartext password in some configurations. In general, it includes the user's...

SUSE CVE-2022-31743

Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. This could have been used to escape HTML comments on pages that put user-controlled data in them. This vulnerability affects Firefox 101...

SUSE CVE-2022-45143

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or...

Video Driver Kernel Local System Failure

The vulnerability of the Video Driver in Linux operating systems is related to insufficient checking of user data. Exploiting this vulnerability can allow an attacker to cause service failures...

SA44328 - 2019-12: Out-Of-Cycle Advisory: Vulnerability Could Allow Attackers to Sniff or Hijack VPN Connections (CVE-2019-14899)

Last Modified Date Aug 23, 2026 9:03:27 PM...

PT-2023-14637

Name of the Vulnerable Software and Affected Versions Vsourz Digital Advanced Contact form 7 DB versions 1.7.2 through 1.9.1 Description The issue is related to Cross Site Scripting XSS, which is a type of attack where an attacker injects malicious scripts into a website, allowing them to steal...

Apple macOS Ventura security vulnerabilities

Apple macOS Ventura is a desktop operating system from Apple Inc. in the United States. A security vulnerability exists in Apple macOS Ventura. An attacker could exploit this vulnerability to obtain sensitive user information...

VulnCheck KEV: CVE-2023-23522

A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Ventura 13.2.1. An app may be able to observe unprotected user data...

PT-2023-16532

Name of the Vulnerable Software and Affected Versions thorsten/phpmyfaq versions prior to 3.1.11 Description The issue is related to Cross-site Scripting XSS - Stored. This type of attack occurs when an application stores user input that contains malicious scripts, which are then executed by the...

Malicious Package

Overview s3transferss is a malicious package. It attempts typosquatting popular packages. The malicious script is base64 obfuscated located in init.py file and tries to steal the current username, platform and IP information and send them to a remote host. Malicious behavior python import getpass...