Archive
21 September 2023
Vulnerabilities first published on this day (UTC), newest first.
6 results · Clear filters · Feed
-
Low 3.7
plone.restapi vulnerable to Stored Cross Site Scripting with SVG image in user portrait
### Impact There is a stored cross site scripting vulnerability for SVG images uploaded in user portraits. Note that a page that uses an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the…
-
Low —
Vulnerable OpenSSL included in cryptography wheels
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 2.5-41.0.3 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openss…
-
Low 3.7
Zope vulnerable to Stored Cross Site Scripting with SVG images
Zope is an open-source web application server. Prior to versions 4.8.10 and 5.8.5, there is a stored cross site scripting vulnerability for SVG images. Note that an image tag with an SVG image as source is never vulnerable, even when the SVG image contains ma…
-
Low 3.3
sudo-rs Session File Relative Path Traversal vulnerability
Sudo-rs, a memory safe implementation of sudo and su, allows users to not have to enter authentication at every sudo attempt, but instead only requiring authentication every once in a while in every terminal or process group. Only once a configurable timeout …
-
Low 3.7
plone.namedfile vulnerable to Stored Cross Site Scripting with SVG images
plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross site scripting vulnerability for SVG images. A security hotfix…
-
Low 3.9
OpenHarmony v3.2.1 and prior version has a system call function usage error
OpenHarmony v3.2.1 and prior version has a system call function usage error. Local attackers can crash kernel by the error input.