CVE-2023-26780

CleverStupidDog yf-exam v 1.8.0 is vulnerable to SQL Injection...

API Umbrella Web 跨站脚本漏洞

API Umbrella Web is an open source library from National Renewable Energy Laboratory. A cross-site scripting vulnerability exists in API Umbrella Web version 0.7.1, which stems from an issue with an unknown portion of the component Admin Data Table Handler that can lead to a cross-site scripting...

Auto Dealer Management System SQL注入漏洞

Auto Dealer Management System is an automobile dealer management system by Carlo Montero Personal Developer. A SQL injection vulnerability exists in Auto Dealer Management System version 1.0, which is caused by an incorrect manipulation of the parameter id that results in an sql injection...

Fortinet FortiNAC 安全漏洞

Fortinet FortiNAC is a zero-trust access solution from Fortinet, Inc. A security vulnerability exists in Fortinet FortiNAC. An attacker could exploit the vulnerability to execute unauthorized code or commands via specially crafted HTTP requests. The following versions are affected: version 9.4.0,...

TOTOLINK CA300-PoE 信任管理问题漏洞

The TOTOLINK CA300-PoE is a wireless access point from China's Gion Electronics TOTOLINK. A security vulnerability exists in the TOTOLINK CA300-PoE version V6.2c.884, which originates from /etc/config/product.ini storing the password for the telnet service...

GPAC 安全漏洞

GPAC is an open source multimedia framework. A security vulnerability exists in GPAC version 2.3-DEV-rev1-g4669ba229-master, which stems from the discovery of a contained buffer overflow vulnerability via the avcparseslice function in mediatools/avparsers.c...

PT-2023-33407 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.269 Description: The issue is related to the use of kzalloc in fbcon prepare logo. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to...

CVE-2022-39187 Rumpus - FTP server Reflected cross-site scripting (RXSS)

Rumpus - FTP server version 9.0.7.1 has a Reflected cross-site scripting RXSS vulnerability through unspecified vectors...

CVE-2022-46178 Path Traversal In MeterSpere allows file upload to any path

MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.1 allow users to upload a file, but do not validate the file name, which may lead to upload file to any path. The vulnerability...

PT-2022-25899 · WordPress · Contest Gallery Pro +1

Name of the Vulnerable Software and Affected Versions: Contest Gallery WordPress plugin versions prior to 19.1.5.1 Contest Gallery Pro WordPress plugin versions prior to 19.1.5.1 Description: The issue allows malicious users with at least author privilege to leak sensitive information from the...

CVE-2022-42949

Silverstripe silverstripe/subsites through 2.6.0 has Insecure Permissions...

GHSA-7RF3-MQPX-H7XG Jettison Out-of-bounds Write vulnerability

A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service DoS via crafted JSON data...

WordPress Defender Security plugin <= 3.3.2 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Calvin Alkan in the WordPress Defender Security plugin versions = 3.3.2. Solution Update the WordPress Defender Security plugin to the latest available version at least 3.3.3...

CVE-2022-4069 Cross-site Scripting (XSS) - Generic in librenms/librenms

Cross-site Scripting XSS - Generic in GitHub repository librenms/librenms prior to 22.10.0...

EARCLINK ESPCMS 安全漏洞

Honghu Erchuang Netlink Information Technology EARCLINK ESPCMS is an enterprise website building system from Honghu Erchuang Netlink Information Technology, China. A security vulnerability exists in EARCLINK ESPCMS version P8.21120101, which originated from the discovery of a remote code executio...

WordPress plugin Analytics Cat 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2022-22834 · Sourcecodester · Sourcecodester Simple Cold Storage Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Cold Storage Management System version 1.0 Description: A vulnerability was found in the Create User Handler component of the SourceCodester Simple Cold Storage Management System. The issue affects some unknown...

SUSE-SU-2022:3571-1 Security update for rubygem-puma

This update for rubygem-puma fixes the following issues: Updated to version 4.3.12: - CVE-2022-24790: Fixed HTTP request smuggling if proxy is not RFC7230 compliant bsc1197818...

WordPress plugin FontMeister 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

SAMSUNG Mobile devices 安全漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc. from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Mobile devices version 18.0.4.14, which stems from an improper authorization vulnerability in Samsung...