PT-2023-15966 · Unknown · Async Http Client

Name of the Vulnerable Software and Affected Versions: Async HTTP Client versions prior to 1.13.2 Description: The issue is related to insufficient validation of HTTP header field values before sending them to the network, allowing attackers to inject new HTTP header fields or entirely new reques...

CVE-2022-43976

An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p03.2.2.17p04.7p0. Direct access to the API is possible on TCP port 8888 via programs located in the cgi-bin folder without any authentication...

DEBIAN-CVE-2022-47318

ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-46648...

The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product.

...

Apache HTTP Server 注入漏洞

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. A CLRF injection vulnerability exists in Apache HTTP Server versions prior to 2.4.55. The vulnerability stems from a Web applicati...

Mechanize 安全漏洞

Mechanize is an open source ruby library from Sparkle Motion. It is used to automate interactions with websites. A security vulnerability exists in versions of Mechanize prior to 0.4.6 that stems from vulnerability to regular expression denial of service ReDoS attacks...

WordPress plugin Themify Portfolio Post 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

phpMyFAQ 安全漏洞

phpMyFAQ is a multilingual, fully database-driven FAQ system by the individual developer Thorsten Rinne. A security vulnerability exists in phpMyFAQ versions prior to 3.1.10, which stems from the presence of weak passwords...

Technitium DNS Server 安全漏洞

Technitium DNS Server is an open source authoritative and recursive DNS server from the Technitium team. It can be used to self-host DNS servers for privacy and security. A security vulnerability exists in versions of Technitium DNS Server prior to 10.0, which stems from a loop occurring in its...

PT-2023-12769 · Com.Fasterxml · Java-Merge-Sort

Name of the Vulnerable Software and Affected Versions: com.fasterxml.util:java-merge-sort versions prior to 1.1.0 Description: The issue is related to an Insecure Temporary File in the StdTempFileProvider function, located in StdTempFileProvider.java. This function utilizes the permissive...

Flarum 安全漏洞

Flarum is an open source forum system for the Flarum community. A security vulnerability exists in versions prior to Flarum v1.6.3. An attacker exploiting this vulnerability could read restricted/private content and bypass access checks for such content...

Zyxel NR7101 安全漏洞

The Zyxel NR7101 is a router from Hopkins Zyxel. A security vulnerability exists in versions prior to Zyxel NR7101 V1.15ACCC.3C0, which stems from a buffer overflow vulnerability in the CGI program parameters that allows an authenticated attacker to cause a denial of service DoS by sending a...

DEBIAN-CVE-2023-0131

Inappropriate implementation in in iframe Sandbox in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to bypass file download restrictions via a crafted HTML page. Chromium security severity: Medium...

PT-2023-14754 · Apache · Mime4J

Name of the Vulnerable Software and Affected Versions: Apache James MIME4J versions prior to 0.8.9 Description: Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. Recommendations: For Apache James MIME...

CVE-2022-47543

An issue was discovered in Siren Investigate before 12.1.7. There is an ACL bypass on global objects...

wing-tight 安全漏洞

wing-tight is an application by aptic lava personal developer. A security vulnerability exists in wing-tight versions prior to 1.0.0, which stems from a problem in the unknown section of the file index.php, where manipulation of the parameter p results in a file inclusion...

Discourse 代码问题漏洞

Discourse is an open source community discussion platform. The platform includes community, email and chat room features. A code issue vulnerability exists in versions prior to Discourse 2.8.14 that stems from when a user requests a password reset linked email and then changes their primary email...

window-control 安全漏洞

window-control is a package from Bruno Robert's personal developer. It is designed to perform tasks similar to robot.js without mouse control, but without compiling external C++ code. A security vulnerability exists in window-control versions prior to 1.4.5, which stems from incorrect input and i...

DEBIAN-CVE-2019-13768

Use after free in FileAPI in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chrome security severity: High...

PT-2023-13620 · WordPress · Visual Email Designer For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Visual Email Designer for WooCommerce WordPress plugin versions prior to 1.7.2 Description: The issue arises from the plugin's failure to properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL...