66 matches found
CVE-2024-24267
gpac v2.2.1 fixed in v2.4.0 was discovered to contain a memory leak via the gfioblob variable in the gffileiofromblob function...
CVE-2024-24267
gpac v2.2.1 fixed in v2.4.0 was discovered to contain a memory leak via the gfioblob variable in the gffileiofromblob function...
CVE-2024-24267
CVE-2024-24267 affects gpac v2.2.1 , with a memory leak in the gfio_blob variable inside the function gf_fileio_from_blob . Root cause: memory not released, leading to potential resource exhaustion. The issue is mitigated by upgrading to gpac v2.4.0 (fixed). Exploitation details are not provided ...
CVE-2024-24266
CVE-2024-24266 affects gpac v2.2.1 with a Use-After-Free (UAF) in dasher_configure_pid (src/filters/dasher.c). Multiple sources (NVD, Red Hat, OSV, CVE lists) confirm the vulnerability in gpac 2.2.1 and attribute it to dasher.c. CVSS v3.1 base score 7.5 (High) with NETWORK attack vector, LOW atta...
Design/Logic Flaw
Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. The following paths in resque-web have been found to be vulnerable to reflected XSS: "/failed/?class=alertdocument.cookie" and "/queues/". This issue has been patched in...
CVE-2023-50725
CVE-2023-50725 affects the Resque library’s web UI (resque-web) where two paths, “/failed/?class=” and “/queues/>”, allow reflected XSS. The root cause is improper input validation on those endpoints. Impact stated across sources: remote authenticated attacker could lure a user to click a craf...
Resque vulnerable to reflected XSS in resque-web failed and queues lists
Impact The following paths in resque-web have been found to be vulnerable to reflected XSS: /failed/?class=alertdocument.cookie /queues/ Patches v2.2.1 Workarounds No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until y...
GHSA-GC3J-VVWF-4RP8 Resque vulnerable to reflected XSS in resque-web failed and queues lists
Impact The following paths in resque-web have been found to be vulnerable to reflected XSS: /failed/?class=alertdocument.cookie /queues/ Patches v2.2.1 Workarounds No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until y...
CVE-2023-2337 ConvertKit < 2.2.1 - Reflected XSS
The ConvertKit WordPress plugin before 2.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Information disclosure
Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs. The vulnerability could allow an attacker with admin privilege to read sensitive information...
CVE-2022-33187 Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs
Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs. The vulnerability could allow an attacker with admin privilege to read sensitive information...
BSA-2022-2026
Security Advisory ID : BSA-2022-2026 Component : Oracle Java SE Revision : 1.0 GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags. Affected Products Brocade SANnav versions before v2.2.1...
CVE-2022-29309
mysiteforme v2.2.1 was discovered to contain a Server-Side Request Forgery...
CVE-2022-29309
mysiteforme v2.2.1 was discovered to contain a Server-Side Request Forgery...
Server side request forgery (ssrf)
mysiteforme v2.2.1 was discovered to contain a Server-Side Request Forgery...
CVE-2022-29309
mysiteforme v2.2.1 was discovered to contain a Server-Side Request Forgery...
CVE-2022-29309
CVE-2022-29309 affects mysiteforme v2.2.1 and is a Server-Side Request Forgery (SSRF). Evidence from PT-2022-19532 indicates the issue is related to SSRF in version 2.2.1 and currently there is no available fix/version documented. Other sources (CNNVD) describe the vulnerability as enabling spoof...
CVE-2020-21650
Myucms v2.2.1 contains a remote code execution RCE vulnerability in the component \controller\Config.php, which can be exploited via the add method...