PT-2023-19224 · Unknown · Snaporbital Panorama Plugin

Name of the Vulnerable Software and Affected Versions: SnapOrbital Panorama plugin versions = 1.5 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For SnapOrbital Panorama plugin versions =...

Wagtail 跨站脚本漏洞

Torchbox Wagtail is an open source content management system CMS from Torchbox UK. A cross-site scripting vulnerability exists in Wagtail versions 1.5 through 4.1.4, 4.2, and 4.2.1, which originates from a user who creates pages and documents, and then a user with elevated privileges can perform...

Apache Commons FileUpload < 1.5 DoS Vulnerability

The Apache Commons FileUpload library is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Security Bulletin: Vulnerability in npm affects IBM VM Recovery Manager

Summary There is vulnerability in npm which affects IBM VM Recovery Manager Vulnerability Details Third Party Entry: 184667 DESCRIPTION: Node.js npm-registry-fetch module could allow a remote attacker to obtain sensitive information, caused by the storing of user credentials in the log file. By...

K24823443: Apache Commons Text vulnerability CVE-2022-42889

Security Advisory Description Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "$prefix:name", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup tha...

SUSE CVE-2009-1757

Cross-site request forgery CSRF vulnerability in Transmission 1.5 before 1.53 and 1.6 before 1.61 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

SUSE CVE-2014-1418

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the 1 Vary: Cookie or 2 Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers...

SUSE CVE-2018-12543

In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting with $, but that is not $SYS, e.g. $test/test, then an assert is triggered that should otherwise not be reachable and Mosquitto will exit...

CVE-2022-44570

A denial of service vulnerability in the Range header parsing component of Rack = 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with...

PT-2023-15565 · Monnai · Aapanel

Name of the Vulnerable Software and Affected Versions: Monnai aaPanel host system version 1.5 Description: The issue allows attackers to escalate privileges and execute arbitrary code via uploading a crafted PHP file to the virtual host directory of the system. This is due to an access control...

CVE-2021-4291 OpenMRS Admin UI Module location.gsp cross site scripting

A vulnerability was found in OpenMRS Admin UI Module up to 1.5.x. It has been declared as problematic. This vulnerability affects unknown code of the file omod/src/main/webapp/pages/metadata/locations/location.gsp. The manipulation leads to cross site scripting. The attack can be initiated...

iBarn 代码问题漏洞

iBarn is an application by zhimengzhe personal developer. It provides file network backup, synchronization and sharing services. A security vulnerability exists in iBarn version 1.5, which originates from a file upload vulnerability in the action/Core.class.php function. An attacker can exploit t...

apache-commons-text: variable interpolation RCE

A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code...

Path traversal

A vulnerability has been found in MZ Automation libiec61850 up to 1.4 and classified as critical. This vulnerability affects unknown code of the file src/mms/isomms/client/mmsclientfiles.c of the component MMS File Services. The manipulation of the argument filename leads to path traversal...

CVE-2022-3976 MZ Automation libiec61850 MMS File Services mms_client_files.c path traversal

A vulnerability has been found in MZ Automation libiec61850 up to 1.4 and classified as critical. This vulnerability affects unknown code of the file src/mms/isomms/client/mmsclientfiles.c of the component MMS File Services. The manipulation of the argument filename leads to path traversal...

Exploit for Code Injection in Apache Commons_Text

CVE-2022-42889-PoC Proof of Concept for CVE-2022-42889 remote...

Apache Commons Text vulnerability CVE-2022-42889

Updated Oct. 19, 2022 CVE-2022-42889 was recently added to the NVD catalog, with a critical score of 9.8. This vulnerability allows remote code execution RCE in Apache Commons Text. It affects version numbers 1.5-1.9, and an upgrade to Apache Commons Text 1.10.0 disables the problem by default...

Arbitrary code execution in Apache Commons Text

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "$prefix:name", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation...

CVE-2021-25044

The Cryptocurrency Pricing list and Ticker WordPress plugin through 1.5 does not sanitise and escape the ccpwsetpage parameter before outputting it back in pages where its shortcode is embed, leading to a Reflected Cross-Site Scripting issue...

PT-2022-4742 · Unknown +1 · Libiec61850 +1

Name of the Vulnerable Software and Affected Versions: libIEC61850 versions 1.4 and prior libIEC61850 version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e Description: The issue is related to errors in pointer dereferencing, which could allow a remote attacker to cause a denial of...