SUSE CVE-2018-3297

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to...

SUSE CVE-2020-12403

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 which was not functioning correctly and strictly enforcing tag length...

SUSE CVE-2020-28016

Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parsefixphrase...

Academy Learning Management System 跨站请求伪造漏洞

Academy Learning Management System is an Academy Learning Management System from the Creativeitem team. A security vulnerability exists in versions of Academy Learning Management System prior to v5.10, which can be exploited by an attacker to create discount coupons when interacting with a page...

Apache::Session::Browseable 信任管理问题漏洞

Apache::Session::Browseable is an Apache::Session implementation that allows indexes to be defined to speed up searches. A security vulnerability exists in Apache::Session::Browseable versions prior to 1.3.6 that stems from not checking the validity of X.509 certificates...

PT-2023-15095 · Nexusphp · Nexusphp

Name of the Vulnerable Software and Affected Versions: NexusPHP versions prior to 1.7.33 Description: The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to reflective cross-site scripting XSS attacks. This can be achieved by injecting malicious input int...

PT-2023-13313 · WordPress · Wpqa Builder

Name of the Vulnerable Software and Affected Versions: WPQA Builder WordPress plugin versions prior to 5.9.3 Description: The issue arises from incorrect validation in the wpqa following you ajax action, allowing a user to inflate their score by receiving repeated follow actions from another user...

JOBE 命令注入漏洞

JOBE is a server for running small programming jobs in various programming languages by Richard Lobb, a personal developer. A command injection vulnerability exists in JOBE versions prior to 1.7.0, which originates in the function runinsandbox in the file application/libraries/LanguageTask.php,...

PT-2023-3459 · Western Digital · Western Digital My Cloud Os 5

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud OS 5 versions prior to 5.26.300 Description: The issue is related to a post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices. This could allow an attacker to execute code ...

OpenMRS 跨站脚本漏洞

OpenMRS is an open source electronic medical record system from OpenMRS, Inc. in the United States. A cross-site scripting vulnerability exists in OpenMRS versions prior to 1.5.0, which originates in the component account settings handler file...

PT-2022-23316 · WordPress · Contact Form 7 Database Addon

Name of the Vulnerable Software and Affected Versions: Contact Form 7 Database Addon WordPress plugin versions prior to 1.2.6.5 Description: The issue concerns the Contact Form 7 Database Addon WordPress plugin, which does not validate data when outputting it back in a CSV file. This could lead t...

PT-2022-24553 · Micro Focus · Micro Focus Filr

Name of the Vulnerable Software and Affected Versions: Micro Focus Filr versions prior to 4.3.1.1 Description: A vulnerability has been identified that could be exploited to allow a remote unauthenticated attacker to enumerate valid users of the system, enabling remote unauthenticated user...

PT-2022-26951 · Delta Electronics · Delta Electronics Diaenergie

Name of the Vulnerable Software and Affected Versions: Delta Electronics DIAEnergie versions prior to v1.9.02.001 Description: The issue allows an attacker to inject SQL queries via the network. This is related to SQL Injection in HandlerTag KID.ashx. Recommendations: For versions prior to...

Atlassian Confluence 路径遍历漏洞

Atlassian Confluence is a suite of specialized enterprise knowledge management and collaboration software from Atlassian Australia that can also be used to build an enterprise WiKi. A path traversal vulnerability exists in Atlassian Confluence versions prior to 1.3.5. An attacker can exploit this...

Rdiffweb 安全漏洞

Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. It provides quick access to your archives through an efficient web interface. A security vulnerability exists in Rdiffweb versions prior to 2.5.0a3, which stems from unrestricted resource allocation...

CVE-2022-38764

A vulnerability on Trend Micro HouseCall version 1.62.1.1133 and below could allow a local attacker to escalate privlieges due to an overly permissive folder om the product installer...

WordPress plugin WordPress Ping Optimizer 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

PT-2022-34265 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.211 Description: A refcount leak was discovered in the qcom smd parse edge function of the rpmsg: qcom smd module. The actual impact and attack plausibility of this issue have not yet been proven...

Nextcloud 加密问题漏洞

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Password Policy, which stems from the fact that its random password generator may, in very rare cases, generat...

Valinor 安全漏洞

Valinor is a PHP library that helps map any input to a strongly typed value object structure. A security vulnerability exists in Valinor versions prior to 0.12.0, which stems from the fact that Valinor can be used without privileges to, for example, display SQL exceptions for SQL fragments, displ...