535 matches found
CWA HTML5 shows incorrect version
After upgrading CWA HTML5 from v2101 to any later versionsE.g. v2309 in the storefront server, the About dialog still shows the old version. The Storefront Console however still shows the correct version...
VulnCheck KEV: CVE-2019-18818
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js...
Workspace App 2203 LTSR CU2 displays a blank white box after login
Citrix Workspace App displays a blank white box after login. Issue does not happen when testing older versions of Citrix Workspace App such as 1912CU3...
CVE-2023-0151 uTubeVideo Gallery < 2.0.8 - Contributor+ Stored XSS
The uTubeVideo Gallery WordPress plugin before 2.0.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Grup Arge Energy and Control Systems SmartPower Energy Management System 输入验证错误漏洞
Grup Arge Energy and Control Systems SmartPower Energy Management System is a web-based system from Grup Arge Energy and Control Systems developed specifically to improve energy efficiency in organizations. A security vulnerability exists in Grup Arge Energy and Control Systems SmartPower Energy...
CVE-2023-0790 Uncaught Exception in thorsten/phpmyfaq
Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11...
CVE-2022-4717 Strong Testimonials < 3.0.3 - Contributor+ Stored XSS via Shortcode
The Strong Testimonials WordPress plugin before 3.0.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...
PT-2023-33777 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.16 Description: The issue is related to a warning in the resp write scat function. The actual impact and attack plausibility have not yet been proven. It was introduced in version v4.16 and fixed in Linux...
CVE-2023-0299 Improper Input Validation in publify/publify
Improper Input Validation in GitHub repository publify/publify prior to 9.2.10...
CVE-2022-34473
The HTML Sanitizer should have sanitized the href attribute of SVG use tags; however it incorrectly did not sanitize xlink:href attributes. This vulnerability affects Firefox 102...
CVE-2022-4560 Joget wflow-core UniversalTheme.java getInternalJsCssLib cross site scripting
A vulnerability was found in Joget up to 7.0.31. It has been rated as problematic. This issue affects the function getInternalJsCssLib of the file wflow-core/src/main/java/org/joget/plugin/enterprise/UniversalTheme.java of the component wflow-core. The manipulation of the argument key leads to...
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
...
DEBIAN-CVE-2022-35256
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling...
CVE-2022-3591 Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0789...
CVE-2022-42919
Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used with the forkserver start method on Linux, allows pickles to be deserialized from any user in the same machine local network...
PT-2022-22282 · Jiusi Oa · Jiusi Oa
Name of the Vulnerable Software and Affected Versions: Jiusi OA affected versions not specified Description: A critical vulnerability was found in Jiusi OA, affecting an unknown functionality of the file /jsoa/hntdCustomDesktopActionContent. The manipulation of the inforid argument leads to SQL...
CVE-2022-34432
Dell Hybrid Client below 1.8 version contains a gedit vulnerability. A guest attacker could potentially exploit this vulnerability, allowing deletion of user and some system files and folders...
PYSEC-2022-43156
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a4...
PT-2022-24804 · Unknown · Matrix-Appservice-Irc
Name of the Vulnerable Software and Affected Versions: matrix-appservice-irc versions prior to 0.35.0 Description: The issue allows attackers to specify a specific string of characters, which would confuse the bridge into combining an attacker-owned channel and an existing channel, allowing them ...
