PT-2023-12402 · Hesburgh Libraries Of Notre Dame · Sipity

Name of the Vulnerable Software and Affected Versions: Hesburgh Libraries of Notre Dame Sipity versions prior to 2021.8 Description: A critical issue has been found, affecting the SearchCriteriaForWorksParameter function in the file app/parameters/sipity/parameters/search criteria for works...

PT-2022-28151 · Usememos · Memos

Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.1 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input and later displays it without proper validation or escaping, allowing an attacke...

PT-2022-28133 · Unknown · Usememos/Memos

Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.1 Description: The issue is related to Cross-Site Request Forgery CSRF in the GitHub repository usememos/memos. CSRF is an attack that tricks a user into performing unintended actions on a web application...

memos 访问控制错误漏洞

memos is an open source hosted meme center with knowledge management and social features. An access control error vulnerability exists in versions of memos prior to 0.9.1, which can be exploited by an attacker to archive victim memos via IDOR...

PYSEC-2022-43010

Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5...

Microweber 代码问题漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A code issue vulnerability exists in Microweber versions prior to 1.3.2, which stems fro...

i18n 输入验证错误漏洞

i18n is a Macaron open source package . It provides internationalization and localization middleware for Macaron applications. An input validation error vulnerability exists in versions of i18n prior to 0.5.0, which stems from a problem with an unknown function in the file i18n.go that results in...

Brave 安全漏洞

Brave is a fast, private and secure web browser from Brave USA. A security vulnerability exists in Brave Browser versions prior to 1.43.88 that could allow a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file containing an ipfs:// or ipns:// URL...

CVE-2022-4690 Cross-site Scripting (XSS) - Stored in usememos/memos

Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.9.0...

CVE-2022-45407

If an attacker loaded a font using FontFace on a background worker, a use-after-free could have occurred, leading to a potentially exploitable crash. This vulnerability affects Firefox 107...

CVE-2022-34469

When a TLS Certificate error occurs on a domain protected by the HSTS header, the browser should not allow the user to bypass the certificate error. On Firefox for Android, the user was presented with the option to bypass the error; this could only have been done by the user explicitly. This bug...

JetBrains IntelliJ IDEA 安全漏洞

JetBrains IntelliJ IDEA is an integrated development environment for the Java language from the Czech company JetBrains. A security vulnerability exists in JetBrains IntelliJ IDEA prior to version 2022.3.1, which is caused by the "Validate JSP file" operation using the HTTP protocol to download t...

ALPINE-CVE-2022-47629

Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser...

CVE-2022-46421 Apache Airflow Hive Provider: Hive Provider RCE vulnerability with hive_cli_params

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider: before 5.0.0...

AZL-34950 CVE-2021-33640 affecting package libtar for versions less than 1.2.20-11

After tarclose, libtar.c releases the memory pointed to by pointer t. After tarclose is called in the list function, it continues to use pointer t: freelonglinklongnamet-thbuf . As a result, the released memory is used use-after-free...

CVE-2022-4058

The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS code later on in another page, which could lead to Stored XSS issue when an attacker makes a logged in admin open a malicious URL or page under their control...

CVE-2022-4050

The JoomSport WordPress plugin before 5.2.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

National Sleep Research Resource 跨站脚本漏洞

National Sleep Research Resource is an open source national sleep research resource system by National Sleep Research Resource. A cross-site scripting vulnerability exists in National Sleep Research Resource versions prior to 59.0.0 that stems from the presence of unknown functionality...

CVE-2022-4438

Use after free in Blink Frames in Google Chrome prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

PT-2022-27224 · Tsolucio · Corebos

Name of the Vulnerable Software and Affected Versions: corebos versions prior to 8.0 Description: The issue is related to PHP Remote File Inclusion in the GitHub repository tsolucio/corebos. Recommendations: For versions prior to 8.0, update to version 8.0 or later to resolve the issue...