4749 matches found
SUSE CVE-2022-4293
Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804...
SUSE CVE-2022-21295
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.32. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...
SUSE CVE-2022-21620
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.40. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromi...
SUSE CVE-2022-21627
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...
SUSE CVE-2022-22827
storeAtts in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow...
SUSE CVE-2022-23493
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol RDP. xrdp v0.9.21 contain a Out of Bound Read in xrdpmmtransprocessdrdynvcchannelclose function. There are no known workarounds for this issue. Users are advised to upgrade...
SUSE CVE-2022-29155
In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping...
SUSE CVE-2022-45419
If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server that used that certificate, and then deleted the exception, Firefox would have kept the connection alive, making it seem like the certificate was still trusted. This vulnerability...
SUSE CVE-2023-0591
ubireaderextractfiles is vulnerable to path traversal when run against specifically crafted UBIFS files, allowing the attacker to overwrite files outside of the extraction directory provided the process has write access to that file or directory. This is due to the fact that a node name...
mruby 缓冲区错误漏洞
mruby is a lightweight implementation of the Ruby language. A security vulnerability exists in versions prior to mruby 3.1.0-rc, which stems from an untrusted pointer destructor in the function mrbvmexec, which can be exploited by an attacker to cause a segmentation error and application crash...
CVE-2023-0362
Themify Portfolio Post WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2023-0379
The Spotlight Social Feeds WordPress plugin before 1.4.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2023-0260 WP Review Slider < 12.2 - Subscriber+ SQLi
The WP Review Slider WordPress plugin before 12.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber...
GPAC 缓冲区错误漏洞
GPAC is an open source multimedia framework. A security vulnerability exists in versions prior to GPAC v2.3.0-DEV that stems from a heap-based buffer overflow...
PT-2023-18444
Name of the Vulnerable Software and Affected Versions Screen Creator Advance 2 versions 0.1.1.4 Build01 and earlier Description An out-of-bound write issue exists due to a lack of error handling when out of specification errors are detected. This could lead to information disclosure and/or...
CVE-2022-45090
Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection. This issue affects Smartpower Web: before 23.01.01...
CVE-2022-45085
Server-Side Request Forgery SSRF vulnerability in Group Arge Energy and Control Systems Smartpower Web allows : Server Side Request Forgery. This issue affects Smartpower Web: before 23.01.01...
CVE-2023-21432
Improper access control vulnerabilities in Smart Things prior to 1.7.93 allows to attacker to invite others without authorization of the owner...