| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the thumb_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue. |
| Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
| Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
| Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
| Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
| Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
| Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
| A vulnerability has been found in fossology and classified as problematic. This vulnerability affects unknown code. The manipulation of the argument sql/VarValue leads to cross site scripting. The attack can be initiated remotely. The patch is identified as 8e0eba001662c7eb35f045b70dd458a4643b4553. It is recommended to apply a patch to fix this issue. VDB-217426 is the identifier assigned to this vulnerability. |
| Fluid is an open source Kubernetes-native Distributed Dataset Orchestrator and Accelerator for data-intensive applications. An OS command injection vulnerability within the Fluid project's JuicefsRuntime can potentially allow an authenticated user, who has the authority to create or update the K8s CRD Dataset/JuicefsRuntime, to execute arbitrary OS commands within the juicefs related containers. This could lead to unauthorized access, modification or deletion of data. Users who're using versions < 0.9.3 with JuicefsRuntime should upgrade to v0.9.3. |
| Cross-site Scripting (XSS) - Stored in GitHub repository linagora/twake prior to 2023.Q1.1200+.
|
| In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09625423; Issue ID: MSV-3033. |
| Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1. |
| Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1. |
| The ABAP Keyword Documentation of SAP NetWeaver Application Server - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, for ABAP and ABAP Platform does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application. |
| Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. |
| In DA, there is a possible permission bypass due to a logic error. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09474894; Issue ID: MSV-2597. |
| An issue in Inkdrop v5.4.1 allows attackers to execute arbitrary commands via uploading a crafted markdown file. |
| Memory corruption in core due to stack-based buffer overflow |
| Memory corruption in Core due to stack-based buffer overflow. |
| Memory corruption in Automotive Android OS due to improper input validation. |
