EulerOS 2.0 SP5 : vim (EulerOS-SA-2022-1283)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - vim is vulnerable to Heap-based Buffer Overflow CVE-2021-3927, CVE-2021-3984, CVE-2021-4019 - vim is vulnerable to Use of Uninitialized Variable...

Cross-site Scripting (XSS)

Apache JSPWiki is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization on the user preference page via the UserName variable...

WordPress Variable Product Swatches for WooCommerce plugin <= 1.0.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Variable Product Swatches for WooCommerce plugin versions = 1.0.1. Solution Update the WordPress Variable Product Swatches for WooCommerce plugin to the latest available version at least 1.0.2...

WordPress Variable Product Swatches for WooCommerce plugin <= 1.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Variable Product Swatches for WooCommerce plugin versions = 1.0.1. Solution Update the WordPress Variable Product Swatches for WooCommerce plugin to the latest available version at least 1.0.2...

EulerOS 2.0 SP10 : vim (EulerOS-SA-2022-1248)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - vim is vulnerable to Heap-based Buffer Overflow CVE-2021-3903, CVE-2021-3927 - vim is vulnerable to Use of Uninitialized Variable CVE-2021-3928 Not...

EulerOS 2.0 SP10 : vim (EulerOS-SA-2022-1260)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - vim is vulnerable to Heap-based Buffer Overflow CVE-2021-3903, CVE-2021-3927 - vim is vulnerable to Use of Uninitialized Variable CVE-2021-3928 Not...

Path traversal

An Authenticated Remote Code Exection RCE vulnerability exists in Xerte through 3.9 in websitecode/php/import/fileupload.php by uploading a maliciously crafted PHP file though the project interface disguised as a language file to bypasses the upload filters. Attackers can manipulate the files...

Xerte 代码问题漏洞

Xerte is an open source software from The Xerte Project community in the UK. Xerte is vulnerable to a code issue where a maliciously crafted php file can be uploaded via a project interface disguised as a language file to bypass upload filters. An attacker could exploit the vulnerability to...

EulerOS 2.0 SP3 : vim (EulerOS-SA-2022-1193)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - vim is vulnerable to Heap-based Buffer Overflow CVE-2021-3778, CVE-2021-3872, CVE-2021-3927 - vim is vulnerable to Use After Free CVE-2021-3796,...

DEBIAN-CVE-2021-44568

Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable via the resolvedependencies function at src/solver.c line 1940 & line 1995, which could cause a remote Denial of Service...

UBUNTU-CVE-2021-44568

Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable via the resolvedependencies function at src/solver.c line 1940 & line 1995, which could cause a remote Denial of Service...

CVE-2020-35215

An issue in Atomix v3.1.5 allows attackers to access sensitive information when a malicious Atomix node queries distributed variable primitives which contain the entire primitive lists that ONOS nodes use to share important states...

CVE-2022-0563

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from t...

CVE-2022-0563

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from t...

CVE-2022-0563

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from t...

CVE-2022-25366

Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables entitlements. An attacker can exploit this by creating a malicious...

Cryptomator 代码问题漏洞

Cryptomator is a simple digital self-defense tool from the Cryptomator community. It is used to protect data. Cryptomator suffers from a code issue vulnerability that stems from the fact that an attacker can exploit the vulnerability can exploit this by creating a malicious .dylib file that can b...

Updated nas packages fix security vulnerability

Stack-based buffer overflow in auphone.c that can be triggered by an environment variable. Also, the x11-util-cf-files package has been patched to allow building nas...

Arbitrary fees

Lines of code Vulnerability details Impact Function transferBribes has a parameter named fees. Essentially, it allows an admin to apply any arbitrary fees and send them to the feeRecipient. This makes no sense because admins can manipulate the amounts however they want with 0 restrictions. I see...

Unchecked feiAmount range

Lines of code Vulnerability details Impact BoosValue could be not safe. Proof of Concept The variable feiAmount is not used during the logic of the method canSafeBoostVault. According to the comment: The amount of Fei asset to check the Safe is authorized boost the Vault with. So this argument mu...