CVE-2022-21548

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle...

Fedora: Security Advisory for meg (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

mTouch Quiz <= 3.1.3 - Admin+ Stored Cross Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup Put the following payload in any of the delimiter...

Samsung KnoxCustomManagerService Access Control Error Vulnerability

Samsung KnoxCustomManagerService is an open source Android platform-based security solution from South Korea's Samsung Samsung that can enhance security across the board through a combination of physical means and software systems, while being perfectly compatible with the Android and Google...

GnuPG through 2.3.6 in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g. use of GPGME) are met allows signature forgery via injection into the status line.

...

CVE-2022-32074

A stored cross-site scripting XSS vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file...

Enhancesoft osTicket 跨站脚本漏洞

Enhancesoft osTicket is an open source ticketing system from Enhancesoft, Inc. in the United States. A security vulnerability exists in Enhancesoft osTicket, which stems from its component audit/class.audit.php that allows attackers to execute arbitrary web script or HTML via a crafted SVG file...

CVE-2022-32115

An issue in the isSVG function of Known v1.2.2+2020061101 allows attackers to execute arbitrary code via a crafted SVG file...

CVE-2022-32115

An issue in the isSVG function of Known v1.2.2+2020061101 allows attackers to execute arbitrary code via a crafted SVG file...

The vulnerability of Microsoft Excel and Microsoft Office Web Apps Server packages lies in the lack of proper input validation, allowing attackers to execute arbitrary code.

The vulnerability of Microsoft Excel and Microsoft Office Web Apps Server programs is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created malicious file...

CVE-2014-3648

The CVE-2014-3648 issue concerns the simplepush server, where notifications are pushed for each registered installation using a deviceToken supplied by the user. The vulnerability arises because a bogus application can register with bad deviceTokens or point to arbitrary HTTP endpoints. This can ...

CVE-2014-3648

The simplepush server iterates through the application installations and pushes a notification to the server provided by deviceToken. But this is user controlled. If a bogus applications is registered with bad deviceTokens, one can generate endless exceptions when those endpoints can't be reached...

Adobe Illustrator Out-of-Bounds Reading Vulnerability (CNVD-2022-50223)

Adobe Illustrator, a vector-based image creation software from Adobe, is vulnerable to an out-of-bounds read vulnerability. An attacker could exploit this vulnerability to cause a sensitive memory leak...

Adobe Illustrator out-of-bounds read vulnerability (CNVD-2022-50222)

Adobe Illustrator, a vector-based image creation software from Adobe, is vulnerable to an out-of-bounds read vulnerability. An attacker could exploit this vulnerability to cause a sensitive memory leak...

Adobe Illustrator Resource Management Error Vulnerability (CNVD-2022-50220)

Adobe Illustrator, a vector-based image creation software from Adobe, is vulnerable to a resource management error. An attacker could use this vulnerability to execute arbitrary code in the context of the current user...

WordPress Site Offline or Coming Soon plugin跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Site Offline or Coming Soon plugin version 1.6.6 and earlier are vulnerable to cross-site request...

Adobe Illustrator out-of-bounds write vulnerability (CNVD-2022-50221)

An out-of-bounds write vulnerability exists in Adobe Illustrator, a vector-based image creation software from Adobe. An attacker could use this vulnerability to execute arbitrary code in the context of the current user...

CVE-2021-40642

Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/lib/txplibmisc.php. The secure flag is not set for txplogin session cookie in the application. If the secure flag is not set, then the cookie will be...

CVE-2022-1964

The Easy SVG Support WordPress plugin before 3.3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

WordPress plugin Easy SVG Support 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. cross-site scripting vulnerability exists in versions prior to WordPress Easy SVG Support plugin 3.3....