mangadex-downloader 输入验证错误漏洞

mangadex-downloader is a command line tool for downloading comics from MangaDex by the individual developer Rahman Yusuf. An input validation error vulnerability exists in versions of mangadex-downloader prior to 1.7.2, which stems from an attempt to open and read a file on local disk for each li...

CVE-2021-40894

A Regular Expression Denial of Service ReDOS vulnerability was discovered in underscore-99xp v1.7.2 when the deepValueSearch function is called...

CVE-2021-40894

A Regular Expression Denial of Service ReDOS vulnerability was discovered in underscore-99xp v1.7.2 when the deepValueSearch function is called...

underscore-99xp 安全漏洞

underscore-99xp is an extension based on the underscore.js experience. underscore-99xp v1.7.2 contains a denial of service vulnerability that stems from a call to the deepValueSearch function that does not properly handle incoming error messages, which could be exploited by an attacker to cause a...

PT-2022-11322 · Unknown · Underscore-99Xp

Name of the Vulnerable Software and Affected Versions: underscore-99xp version 1.7.2 Description: A Regular Expression Denial of Service ReDOS issue was found when the deepValueSearch function is called. Recommendations: For underscore-99xp version 1.7.2, consider disabling the deepValueSearch...

CVE-2022-24777 Denial of Service via reachable assertion in grpc-swift

grpc-swift is the Swift language implementation of gRPC, a remote procedure call RPC framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: ...

CVE-2022-24777 Denial of Service via reachable assertion in grpc-swift

grpc-swift is the Swift language implementation of gRPC, a remote procedure call RPC framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: ...

CVE-2021-39013

IBM Cloud Pak for Security CP4S 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to obtain sensitive information in HTTP responses that could be used in further attacks against the system. IBM X-Force ID: 213651...

PT-2021-16216

Name of the Vulnerable Software and Affected Versions Video Lessons Manager WordPress plugin versions prior to 1.7.2 Video Lessons Manager Pro WordPress plugin versions prior to 3.5.9 Description The issue concerns the improper sanitization and escaping of values when updating settings, potential...

CVE-2021-40889

CMSUno version 1.7.2 is affected by a PHP code execution vulnerability. sauvePass action in webroot/uno/central.php file calls to fileputcontents function to write username in password.php file when a user successfully changed their password. The attacker can inject malicious PHP code into...

CVE-2021-40889

CMSUno 1.7.2 is affected by a PHP code execution vulnerability. The sauvePass action in {webroot}/uno/central.php writes the username to password.php via file_put_contents() after a password change, allowing an attacker to inject PHP code into password.php and trigger code execution through login...

CMSUno 代码注入漏洞

CMSUno is a tool for creating single-page responsive websites from the French individual developer Jacques Malgrange. A security vulnerability exists in CMSUno version 1.7.2, which stems from the software being affected by a PHP code execution vulnerability. When a user successfully changes their...

CVE-2021-3747

The MacOS version of Multipass, version 1.7.0, fixed in 1.7.2, accidentally installed the application directory with incorrect owner...

CVE-2021-38329

The DJ EmailPublish WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /dj-email-publish.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.7.2...

WordPress 插件 跨站脚本漏洞

WordPress Plugin is an open source application plugin for WordPress. The WordPress plugin DJ EmailPublish suffers from a cross-site scripting vulnerability that stems from the fact that version 1.7.2 of the DJ EmailPublish WordPress plugin is susceptible to reflected cross-site scripting attacks...

CVE-2021-24590

The Cookie Notice & Consent Banner for GDPR & CCPA Compliance WordPress plugin before 1.7.2 does not properly sanitize inputs to prevent injection of arbitrary HTML within the plugin's design customization options...

CVE-2021-27491

Ypsomed mylife Cloud, mylife Mobile Application:Ypsomed mylife Cloud,All versions prior to 1.7.2,Ypsomed mylife App,All versions prior to 1.7.5,The Ypsomed mylife Cloud discloses password hashes during the registration process...

Design/Logic Flaw

Ypsomed mylife Cloud, mylife Mobile Application:Ypsomed mylife Cloud,All versions prior to 1.7.2,Ypsomed mylife App,All versions prior to 1.7.5,he Ypsomed mylife Cloud reflects the user password during the login process after redirecting the user from a HTTPS endpoint to a HTTP endpoint...

Vault Renewed Nearly-Expired Leases With Incorrect Non-Expiring TTLs

Summary Vault and Vault Enterprise “Vault” allowed the renewal of nearly-expired token leases and dynamic secret leases specifically, those within 1 second of their maximum TTL, which caused them to be incorrectly treated as non-expiring during subsequent use. This vulnerability, CVE-2021-32923,...

WordPress插件 跨站脚本漏洞

Patreon is a subscription-based crowdfunding platform and Patreon WordPress is a WordPress plugin for the platform. A cross-site scripting vulnerability exists in Patreon WordPress versions prior to 1.7.2. An attacker can exploit this vulnerability to conduct cross-site scripting attacks via the...