github-module 信任管理问题漏洞

github-module is a GitHub integration for Nuxt. A trust management issue vulnerability exists in nuxtlabs github-module versions prior to 1.6.2, which stems from the use of hard-coded credentials...

SUSE CVE-2021-46872

An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earli...

WordPress Album and Image Gallery plus Lightbox Plugin <= 1.6.2 is vulnerable to Broken Access Control

Software Album and Image Gallery plus Lightbox Type Plugin Vulnerable versions = 1.6.2 Fixed in 1.6.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-25060 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID dd001a553b6f Credits Cat...

DEBIAN-CVE-2021-46872

An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earli...

UBUNTU-CVE-2021-46872

An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earli...

PT-2023-12595 · Nim +2 · Nim +2

Name of the Vulnerable Software and Affected Versions: Nim versions prior to 1.6.2 NimForum versions prior to 2.2.0 Description: An issue in the RST module of the Nim language stdlib allows the javascript: URI scheme, potentially leading to XSS in some applications. Recommendations: For Nim...

CVE-2023-22463 KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token

KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Furthermor...

Deark 缓冲区错误漏洞

Jason Summers deark is a Jason Summers open source application. A command line utility program that can decode certain types of files. A security vulnerability exists in version v.1.6.2 of deark, which stems from the doprismreadpalette function of its /modules/atari-img.c component that allows an...

CVE-2022-43289

Deark v.1.6.2 was discovered to contain a stack overflow via the doprismreadpalette function at /modules/atari-img.c...

WordPress plugin LoginPress 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2022-26091 · WordPress · Wordpress Loginpress

Name of the Vulnerable Software and Affected Versions: WordPress LoginPress plugin versions 1.6.2 and earlier Description: A Broken Access Control issue exists, allowing unauthorized changes to Opt-In or Opt-Out tracking settings. Recommendations: For WordPress LoginPress plugin versions 1.6.2 an...

OESA-2022-2021 libksba security update

Libksba is a library to make the tasks of working with X.509 certificates,CMS data and related objects more easy. It provides a highlevel interface to the implemented protocols and presents the data in a consistent way. Security Fixes: A bug found in libksba, the library used by GnuPG for parsing...

UBUNTU-CVE-2022-39831

An issue was discovered in PSPP 1.6.2. There is a heap-based buffer overflow at the function readbytesinternal in utilities/pspp-dump-sav.c, which allows attackers to cause a denial of service application crash or possibly have unspecified other impact. This issue is different from CVE-2018-20230...

PT-2022-25023 · Pspp +1 · Pspp +1

Name of the Vulnerable Software and Affected Versions: PSPP version 1.6.2 Description: An issue was discovered that allows attackers to cause a denial of service or possibly have other unspecified impacts due to a heap-based buffer overflow at the read string function in utilities/pspp-dump-sav.c...

GNU PSPP 缓冲区错误漏洞

GNU PSPP is an application for data sampling, statistics and analysis. A security vulnerability exists in GNU PSPP version 1.6.2, which stems from a heap-based buffer overflow in the function readstring in utilities/pspp-dump-sav.c. This allows attackers to cause a denial of service application...

CVE-2021-34083

Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browser' option in versions up to 1.6.2, google-it will unsafely concat the result's link retrieved from google to a shell command, potentially...

Google-it 操作系统命令注入漏洞

Google-it is a simple library for converting Google search results to JSON output, and will soon offer interactive display options. A security vulnerability exists in Google-it version 1.6.2 and earlier, which stems from the fact that it allows its users to send a search query to Google and recei...

Information Exposure

Overview Microsoft.ChakraCore.vc140 is a core part of the Chakra JavaScript engine that powers Microsoft Edge Affected versions of this package are vulnerable to Information Exposure. Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the...

Permissions bypass in SmallRye

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data...

Command Injection

Overview cocoapods-downloader is an A small library for downloading files from remotes in a folder. Affected versions of this package are vulnerable to Command Injection via hg argument injection. When calling the download function when using hg, the url and/or revision, tag, branch is passed to...