PYSEC-2022-36

Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher...

PT-2022-12120 · Apache · Apache Superset

Name of the Vulnerable Software and Affected Versions: Apache Superset versions up to and including 1.3.2 Description: The issue allows for the leak of registered database connections passwords to authenticated users. This information can be accessed in a non-trivial way. Recommendations: For...

UBUNTU-CVE-2022-21670

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading...

PT-2022-9478 · WordPress · Tab

Name of the Vulnerable Software and Affected Versions: Tab WordPress plugin versions prior to 1.3.2 Description: The issue allows unauthenticated attackers to modify various data in the plugin, such as add, edit, or delete arbitrary tabs, because all AJAX actions of the Tab WordPress plugin are...

HPESBGN04223 rev.1 - HPE Remote SIM Provisioning Manager (RSPM), Apache Log4j 2 Remote Arbitrary Code Execution and Remote Code Execution

Potential Security Impact: Remote: Arbitrary Code Execution, Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Remote SIM Provisioning Manager RSPM - RSPM1.3.2, RSPM1.4.1 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2021-44228 |...

AbanteCart 跨站脚本漏洞

AbanteCart is a PHP-based e-commerce platform. AbanteCart 1.3.2 previously had a security vulnerability that could be exploited by attackers to conduct DOM-based XSS attacks...

PT-2021-23489 · Unknown · Abantecart

Name of the Vulnerable Software and Affected Versions: AbanteCart versions prior to 1.3.2 Description: An issue was discovered that allows DOM Based XSS. Recommendations: For versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue...

WordPress Tab – Accordion, FAQ plugin <= 1.3.1 - Unauthenticated AJAX Calls vulnerability

Unauthenticated AJAX Calls vulnerability discovered by Brandon Roldan in WordPress Tab – Accordion, FAQ plugin versions = 1.3.1. Solution Update the WordPress Tab – Accordion, FAQ plugin to the latest available version at least 1.3.2...

CVE-2021-24554

The Paytm – Donation Plugin WordPress plugin through 1.3.2 does not sanitise, validate or escape the id GET parameter before using it in a SQL statement when deleting donations, leading to an authenticated SQL injection issue...

CVE-2021-39368

Canon Oce Print Exec Workgroup 1.3.2 allows XSS via the lang parameter...

Canon Oce Print Exec Workgroup 安全漏洞

Canon Oce Print Exec Workgroup is a software application from Canon Japan. A program that displays basic printer information. A security vulnerability exists in Canon Oce Print Exec Workgroup, which stems from Canon Oce Print Exec Workgroup 1.3.2 allows host header injection. An attacker could...

CVE-2021-34643

The Skaut bazar WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /skaut-bazar.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.2...

gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation

A flaw was found in github.com/gogo/protobuf before 1.3.2 that allows an out-of-bounds access when unmarshalling certain protobuf objects. This flaw allows a remote attacker to send crafted protobuf messages, causing panic and resulting in a denial of service. The highest threat from this...

Paytm - Donation Plugin <= 1.3.2 - Authenticated (admin+) SQL Injection

The plugin does not sanitise, validate or escape the id GET parameter before using it in a SQL statement when deleting donations, leading to an authenticated SQL injection issue PoC GET /wp-admin/admin.php?page=wppaytmdonation=delete=1%20AND%20SELECT%205581%20FROM%20SELECTSLEEP5Pjwy HTTP/1.1...

Halo Server-Side Request Forgery Vulnerability

Halo is a light and clean Java blogging system. A server-side request forgery vulnerability exists in the SMTP configuration in Halo 1.3.2 and earlier versions, which can be exploited by an attacker to detect a server intranet...

CVE-2021-24434

The Glass WordPress plugin through 1.3.2 does not sanitise or escape its "Glass Pages" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin did not have CSRF check in place when saving its settings, allowing the issue to be exploited via a...

Halo 代码问题漏洞

Halo is a light and clean Java blogging system. A server-side request forgery vulnerability exists in the SMTP configuration in Halo 1.3.2 and earlier versions, which can be exploited by an attacker to detect a server intranet...

White Shark System (WSS) SQL Injection Vulnerability (CNVD-2021-44705)

White Shark System WSS is a browser-based collaboration platform that integrates Project Management, Task Management, Work Management and Work Log Management. Project Management", "Task Management", "Work Management" and "Work Log Management". A SQL injection vulnerability exists in White Shark...

White Shark System (WSS) Website Physical Path Disclosure Vulnerability

White Shark System WSS is a browser-based collaboration platform that integrates Project Management, Task Management, Work Management and Work Log Management. Project Management", "Task Management", "Work Management" and "Work Log Management". A website physical path disclosure vulnerability exis...

White Shark System (WSS) Unauthorized Access Vulnerability

White Shark System WSS is a browser-based collaboration platform that integrates Project Management, Task Management, Work Management and Work Log Management. Project Management", "Task Management", "Work Management" and "Work Log Management". An unauthorized access vulnerability exists in...