CVE-2023-5016

A vulnerability was found in spider-flow up to 0.5.0. It has been declared as critical. Affected by this vulnerability is the function DriverManager.getConnection of the file src/main/java/org/spiderflow/controller/DataSourceController.java of the component API. The manipulation leads to...

Apache NiFi Trust Management Issues Vulnerability

Apache NiFi is a data processing and distribution system from the Apache USA Foundation. The system is primarily used for data routing, transformation, and system brokering logic. A trust management issue vulnerability exists in Apache NiFi MiNiFi C++ versions 0.13 through 0.14, which stems from...

WordPress plugin Advanced Category Template 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

Open-Falcon dashboard security vulnerability

dashboard is Open-Falcon open source an Open Falcon unified default front-end component. A security vulnerability exists in Open-Falcon dashboard version 0.2.0, which originated from a vulnerability that allows an attacker to obtain, modify, and delete sensitive information by designing the POST...

CVE-2022-30858

An issue was discovered in ngiflib 0.4. There is SEGV in SDLLoadAnimatedGif when use SDLaffgif. poc : ./SDLaffgif CAfile20...

OPENSUSE-SU-2023:0162-1 Security update for xonotic

This update for xonotic fixes the following issues: Update to version 0.8.6 SECURITY ALERT: A bug was discovered in versions older than 0.8.6 that is believed to be exploitable by malicious server admins to crash clients or, if they defeat mitigations, execute arbitrary code. boo1212632 update to...

PT-2023-21939 · Netconsd · Netconsd

Name of the Vulnerable Software and Affected Versions: netconsd versions prior to 0.2 Description: The issue is related to an integer overflow in the parse packet function, which can be exploited by a malicious individual to create heap memory corruption with attacker-controlled data...

CVE-2023-25309

Cross Site Scripting XSS Vulnerability in Fetlife rollout-ui version 0.5, allows attackers to execute arbitrary code via a crafted url to the delete a feature functionality...

PoDoFo 资源管理错误漏洞

PoDoFo is a free portable C++ library open-sourced by PoDoFo. A resource management error vulnerability exists in PoDoFo version 0.10.0, which stems from the function PoDoFo::PdfEncrypt::IsMetadataEncrypted containing heap reuse after release. A remote attacker can exploit this vulnerability to...

WordPress plugin Woocommerce Custom Checkout Fields Editor With Drag & Drop 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-26016

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Tauhidul Alam Simple Portfolio Gallery plugin = 0.1 versions...

CVE-2023-30524

Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the potential for attackers to observe and capture them...

PT-2023-22753 · Jenkins · Jenkins Report Portal Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Report Portal Plugin versions 0.5 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified URL using attacker-specified bearer token authentication. This issue arise...

CVE-2022-47592

Reflected Cross-Site Scripting XSS vulnerability in Dmytriy.Cooperman MagicForm plugin = 0.1 versions...

SUSE CVE-2011-3639

The modproxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of 1 RewriteRule and 2 ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to...

SUSE CVE-2020-7928

A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries. This issue affects MongoDB Server v4.4 versions prior to 4.4.1; MongoDB Server v4.2 versions prior to 4.2.9; MongoDB Server v4.0 versions prior to 4.0.20 and...

SUSE CVE-2020-25652

A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX domain socket in /run/spice-vdagentd/spice-vdagent-sock. Any unprivileged local guest user could use this flaw to prevent legitimate agents from connecting to th...

SUSE CVE-2021-31155

Failure to normalize the umask in please before 0.4 allows a local attacker to gain full root privileges if they are allowed to execute at least one command...

SUSE CVE-2022-47021

A null pointer dereference issue was discovered in functions opgetdata and opopen1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows attackers to cause denial of service or other unspecified impacts...

CVE-2022-4473 Widget Shortcode <= 0.3.5 - Contributor+ Stored XSS

The Widget Shortcode WordPress plugin through 0.3.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...