🚨 CVE-2022-0395
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
🎖@cveNotify
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
🎖@cveNotify
GitHub
Escape in user box · LiveHelperChat/livehelperchat@8fdb4f6
Live Helper Chat - live support for your website. Featuring web and mobile apps, Voice & Video & ScreenShare. Supports Telegram, Twilio (whatsapp), Facebook messenger including building a bot. - Escape in user box · LiveHelperChat/livehelperchat@8fdb4f6
🚨 CVE-2022-0352
Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16.
🎖@cveNotify
Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16.
🎖@cveNotify
GitHub
Prevent wrong use of safe statement · janeczku/calibre-web@6bf0753
:books: Web app for browsing, reading and downloading eBooks stored in a Calibre database - Prevent wrong use of safe statement · janeczku/calibre-web@6bf0753
🚨 CVE-2021-4160
There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH private key among multiple clients, which is no longer an option since CVE-2016-0701. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0.0. It was addressed in the releases of 1.1.1m and 3.0.1 on the 15th of December 2021. For the 1.0.2 release it is addressed in git commit 6fc1aaaf3 that is available to premium support customers only. It will be made available in 1.0.2zc when it is released. The issue only affects OpenSSL on MIPS platforms. Fixed in OpenSSL 3.0.1 (Affected 3.0.0). Fixed in OpenSSL 1.1.1m (Affected 1.1.1-1.1.1l). Fixed in OpenSSL 1.0.2zc-dev (Affected 1.0.2-1.0.2zb).
🎖@cveNotify
There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH private key among multiple clients, which is no longer an option since CVE-2016-0701. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0.0. It was addressed in the releases of 1.1.1m and 3.0.1 on the 15th of December 2021. For the 1.0.2 release it is addressed in git commit 6fc1aaaf3 that is available to premium support customers only. It will be made available in 1.0.2zc when it is released. The issue only affects OpenSSL on MIPS platforms. Fixed in OpenSSL 3.0.1 (Affected 3.0.0). Fixed in OpenSSL 1.1.1m (Affected 1.1.1-1.1.1l). Fixed in OpenSSL 1.0.2zc-dev (Affected 1.0.2-1.0.2zb).
🎖@cveNotify
🚨 CVE-2021-46448
H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/customers.php?page=1&cID.
🎖@cveNotify
H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/customers.php?page=1&cID.
🎖@cveNotify
GitHub
PoCs/exploit_hhg_multistore.md at main · blockomat2100/PoCs
Contribute to blockomat2100/PoCs development by creating an account on GitHub.
🚨 CVE-2021-46447
A cross-site scripting (XSS) vulnerability in H.H.G Multistore v5.1.0 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the State parameter under the Address Book module.
🎖@cveNotify
A cross-site scripting (XSS) vulnerability in H.H.G Multistore v5.1.0 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the State parameter under the Address Book module.
🎖@cveNotify
GitHub
PoCs/exploit_hhg_multistore.md at main · blockomat2100/PoCs
Contribute to blockomat2100/PoCs development by creating an account on GitHub.
🚨 CVE-2021-46446
H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin_access_group_edit&aagID.
🎖@cveNotify
H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin_access_group_edit&aagID.
🎖@cveNotify
GitHub
PoCs/exploit_hhg_multistore.md at main · blockomat2100/PoCs
Contribute to blockomat2100/PoCs development by creating an account on GitHub.
🚨 CVE-2021-46445
H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/categories.php?box_group_id.
🎖@cveNotify
H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/categories.php?box_group_id.
🎖@cveNotify
GitHub
PoCs/exploit_hhg_multistore.md at main · blockomat2100/PoCs
Contribute to blockomat2100/PoCs development by creating an account on GitHub.
🚨 CVE-2021-46444
H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin_group_edit&agID.
🎖@cveNotify
H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin_group_edit&agID.
🎖@cveNotify
GitHub
PoCs/exploit_hhg_multistore.md at main · blockomat2100/PoCs
Contribute to blockomat2100/PoCs development by creating an account on GitHub.
🚨 CVE-2021-3866
Cross-site Scripting (XSS) - Stored in GitHub repository zulip/zulip more than and including 44f935695d452cc3fb16845a0c6af710438b153d and prior to 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6.
🎖@cveNotify
Cross-site Scripting (XSS) - Stored in GitHub repository zulip/zulip more than and including 44f935695d452cc3fb16845a0c6af710438b153d and prior to 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6.
🎖@cveNotify
huntr.dev
Cross-site Scripting (XSS) - Stored in zulip
14.81K developers have been protected by securing zulip. Read this report, and explore others to learn how you can also protect the world by earning cash and CVEs.
🚨 CVE-2022-0351
Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.
🎖@cveNotify
Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.
🎖@cveNotify
GitHub
patch 8.2.4206: condition with many "(" causes a crash · vim/vim@fe6fb26
Problem: Condition with many "(" causes a crash.
Solution: Limit recursion to 1000.
Solution: Limit recursion to 1000.
🚨 CVE-2022-24122
kernel/ucount.c in the Linux kernel 5.14 through 5.16.4, when unprivileged user namespaces are enabled, allows a use-after-free and privilege escalation because a ucounts object can outlive its namespace.
🎖@cveNotify
kernel/ucount.c in the Linux kernel 5.14 through 5.16.4, when unprivileged user namespaces are enabled, allows a use-after-free and privilege escalation because a ucounts object can outlive its namespace.
🎖@cveNotify
🚨 CVE-2022-24124
The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.
🎖@cveNotify
The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.
🎖@cveNotify
GitHub
Comparing v1.13.0...v1.13.1 · casdoor/casdoor
An Identity and Access Management (IAM) / Single-Sign-On (SSO) platform with web UI supporting OAuth 2.0 / OIDC and SAML authentication, QQ group: 645200447 - Comparing v1.13.0...v1.13.1 · casdoor/...
🚨 CVE-2022-24123
MarkText through 0.16.3 does not sanitize the input of a mermaid block before rendering. This could lead to Remote Code Execution via a .md file containing a mutation Cross-Site Scripting (XSS) payload.
🎖@cveNotify
MarkText through 0.16.3 does not sanitize the input of a mermaid block before rendering. This could lead to Remote Code Execution via a .md file containing a mutation Cross-Site Scripting (XSS) payload.
🎖@cveNotify
GitHub
XSS to RCE vulnerability in Mermaid rendered · Issue #2946 · marktext/marktext
Description According to #2504 , it will add a closing element at the end, which means it tries to parse it as HTML. Can you reproduce the issue? Steps to reproduce Insert the following code into a...
🚨 CVE-2021-46659
MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECT_LEX::nest_level is local to each VIEW.
🎖@cveNotify
MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECT_LEX::nest_level is local to each VIEW.
🎖@cveNotify