8565 matches found
flatpak: Metadata with ANSI control codes can cause misleading terminal output
A flaw was found in Flatpak, a system for building, distributing, and running sandboxed desktop applications on Linux. Suppose an attacker publishes a Flatpak app with elevated permissions. In that case, they can hide those permissions from users of the flatpak1 command-line interface by setting...
PT-2023-14644 · Unknown · Simple History – User Activity Log
Name of the Vulnerable Software and Affected Versions: Simple History – user activity log, audit tool versions 3.3.1 and earlier Description: The issue is related to the improper neutralization of formula elements in a CSV file. This can potentially lead to security risks when handling CSV files...
PT-2023-20408 · Unknown · Wpomnia Kb Support
Name of the Vulnerable Software and Affected Versions: WPOmnia KB Support versions 1.5.84 and earlier Description: The issue is related to the improper neutralization of formula elements in a CSV file, which affects WPOmnia KB Support. Recommendations: For versions 1.5.84 and earlier, update to a...
WordPress Plugin Post to CSV by BestWebSoft Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...
PT-2023-14647 · Unknown · Lenderd 1003 Mortgage Application
Name of the Vulnerable Software and Affected Versions: Lenderd 1003 Mortgage Application versions 1.75 and earlier Description: The issue is related to the improper neutralization of formula elements in a CSV file, which affects the 1003 Mortgage Application. Recommendations: For versions 1.75 an...
PT-2023-18662 · Givewp · Givewp
Name of the Vulnerable Software and Affected Versions: GiveWP versions through 2.25.1 Description: The issue is related to the improper neutralization of formula elements in a CSV file. This affects the functionality of the software, potentially leading to unintended consequences. Recommendations...
PT-2023-19211 · Unknown · Muneeb Form Builder
Name of the Vulnerable Software and Affected Versions: Muneeb Form Builder | Create Responsive Contact Forms versions 1.9.9.0 and earlier Description: The issue is related to the improper neutralization of formula elements in a CSV file. This could potentially lead to unintended actions when a CS...
PT-2023-15318 · Userswp · Userswp
Name of the Vulnerable Software and Affected Versions: UsersWP versions 1.2.3.9 and earlier Description: The issue is related to the improper neutralization of formula elements in a CSV file, which affects the UsersWP software. Recommendations: For versions 1.2.3.9 and earlier, update to a versio...
ALSA-2023:6474 Moderate: podman security, bug fix, and enhancement update
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: golang: html/template: improper handling of JavaScript whitespace CVE-2023-24540 net/http...
CVE-2023-5719
The Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for users and to download the resulting security configuration to a device. If such a password contains the percent % character, invalid values will be included, potentially truncating...
Juniper Networks Junos Router PPMD DoS
The vulnerability of the PPMD module in Juniper Networks Junos routers of the MX series operating systems is related to improper handling of indeterminate values. Exploiting this vulnerability can allow an attacker to cause service interruptions remotely...
Upgraded Q -> 2 from #175 [1699029356616]
Judge has assessed an item in Issue 175 as 2 risk. The relevant finding follows: L-02 Initial values for GovernorSettings are very low ODGovernor is a OZ Governor with some plugins. It sets up its parameters in the constructor: ODGovernor::constructor: File: src/contracts/gov/ODGovernor.sol 41:...
Security Bulletin: IBM Storage Ceph is vulnerable via use of insufficiently random values and via exposure of sensitive information to an unauthorized actor in Golang (CVE-2022-30629)
Summary Golang is used by IBM Storage Ceph as part of RGW and in assorted other locations. CVE-2022-30629 Vulnerability Details CVEID: CVE-2022-30629 DESCRIPTION: Golang Go could allow a remote attacker to obtain sensitive information, caused by an issue with session tickets generated by crypto/t...
Weak Cryptography
jose4j is vulnerable to Weak Cryptography. The vulnerability is present in Pbes2HmacShaWithAesKeyWrapAlgorithm.java due to the ability to set a small iteration count when using the PBE Password-Based Encryption algorithm. This weakness enables an attacker to determine hashed password values...
Khan Academy: Text Injection/ Content Spoofing on https://cloud.e.khanacademy.org by breaking out of input tag.
A vulnerability was discovered on https://cloud.e.khanacademy.org that allowed text injection via breaking out of an input tag. By inserting a closing angle bracket in a parameter value, an attacker could inject arbitrary text that would be reflected on the page, enabling phishing attacks. The...
CVE-2023-45671
Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the "/" base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to bot...
CVE-2023-46754
The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary numerical values...
Authorization
The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary numerical values...
