Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
90 results · page 1 of 2
Aug 24, 2026A vulnerability has been found in Piwigo 16.3.0.CVE-2026-78187 · Other software · reported by VulDBLow 1.3
A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang leads to cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 16.4.0 will fix this issue. The name of the patch is 5277a7dee4b8f1a174f1d69e1e2a4e1c82a3fc9e. It is recommended to upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026A weakness has been identified in bufanyun HotGo 1.0/2.0.CVE-2026-5253 · Other software · bufanyun · reported by VulDBLow 2
A weakness has been identified in bufanyun HotGo 1.0/2.0. Affected by this vulnerability is an unknown functionality of the file /web/src/layout/components/Header/MessageList.vue of the component editNotice Endpoint. Executing a manipulation can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- HotGo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025RockMongo 1.1.7 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple unencoded input parameteCVE-2023-53938 · Other software · iwind · reported by VulnCheckMedium 5.1
RockMongo 1.1.7 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple unencoded input parameters. Attackers can exploit the vulnerability by submitting crafted payloads in database, collection, and login parameters to execute arbitrary JavaScript in victim's browser.
- Product
- RockMongo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Nov 12, 2025An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service (DoS) via crafted JSON Web Encryption (JWE) tCVE-2025-63811 · Other software · Dvsekhvalnov · reported by MITREHigh 7.5
An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service (DoS) via crafted JSON Web Encryption (JWE) token with an exceptionally high compression ratio.
- Product
- Jose2go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2025Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register.CVE-2024-43018 · Other software · Piwigo · reported by MITREMedium 6.4
Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register. These parameters are used in ws_user_gerList function from file include\ws_functions\pwg.users.php and this same function is called by ws.php file at some point can be used for searching users in advanced way in /admin.php?page=user_list.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2023Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time.CVE-2023-45287 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant time RSA implementation, which we do not believe exhibits any timing side channels.
- Product
- crypto/tls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2023The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" commandCVE-2023-39320 · Other software · Go toolchain · reported by security@golang.orgCritical 9.8
The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2023Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function.CVE-2023-34626 · Other software · Piwigo · reported by MITREMedium 4.3
Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2023Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.CVE-2023-33362 · Other software · Piwigo · reported by MITRECritical 9.8
Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2023Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php.CVE-2023-33361 · Other software · Piwigo · reported by MITRECritical 9.8
Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2023Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the "add tags" function.CVE-2023-33359 · Other software · Piwigo · reported by MITREMedium 4.3
Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the "add tags" function.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022Piwigo 12.3.0 is vulnerable to Cross Site Scripting (XSS) via /search/1940/created-monthly-list.CVE-2022-37183 · Other software · Piwigo · reported by MITREMedium 6.1
Piwigo 12.3.0 is vulnerable to Cross Site Scripting (XSS) via /search/1940/created-monthly-list.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.CVE-2022-32148 · Other software · Go standard library · reported by security@golang.orgMedium 6.5
Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.
- Product
- net/http
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a messaCVE-2022-30635 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.
- Product
- encoding/gob
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshallinCVE-2022-30633 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.
- Product
- encoding/xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containinCVE-2022-30632 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.
- Product
- path/filepath
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archivCVE-2022-30631 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.
- Product
- compress/gzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a CVE-2022-30630 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.
- Product
- io/fs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correCVE-2022-30629 · Other software · Go standard library · reported by security@golang.orgLow 3.1
Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.
- Product
- crypto/tls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe"CVE-2022-30580 · Other software · Go standard library · reported by security@golang.orgHigh 7.8
Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.
- Product
- os/exec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential dirCVE-2022-29804 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.
- Product
- path/filepath
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply CVE-2022-28131 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.
- Product
- encoding/xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeplyCVE-2022-1962 · Other software · Go standard library · reported by security@golang.orgMedium 5.5
Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.
- Product
- go/parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined CVE-2022-1705 · Other software · Go standard library · reported by security@golang.orgMedium 6.5
Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.
- Product
- net/http
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2022Using off-the-shelf commodity hardware, the Unitree Go 1 robotics platform version H0.1.7 and H0.1.9 (using firmware version 0.1.35) can be powered down by an aCVE-2022-2675 · Other software · Unitree · reported by cve@rapid7.comMedium 6.5
Using off-the-shelf commodity hardware, the Unitree Go 1 robotics platform version H0.1.7 and H0.1.9 (using firmware version 0.1.35) can be powered down by an attacker within normal RF range without authentication. Other versions may be affected, such as the A1.
- Product
- Go 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2022Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 <<CVE-2022-30634 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.
- Product
- crypto/rand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022piwigo 11.5.0 is affected by a remote code execution (RCE) vulnerability in the LocalFiles Editor.CVE-2021-40553 · Other software · Piwigo · reported by MITREHigh 8.8
piwigo 11.5.0 is affected by a remote code execution (RCE) vulnerability in the LocalFiles Editor.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022In Piwigo 11.5.0, there exists a persistent cross-site scripting in the single mode function through /admin.php?page=batch_manager&mode=unit.CVE-2021-40678 · Other software · Piwigo · reported by MITREMedium 5.4
In Piwigo 11.5.0, there exists a persistent cross-site scripting in the single mode function through /admin.php?page=batch_manager&mode=unit.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022Piwigo 11.5.0 is affected by a SQL injection vulnerability via admin.php and the id parameter.CVE-2021-40317 · Other software · Piwigo · reported by MITREHigh 8.8
Piwigo 11.5.0 is affected by a SQL injection vulnerability via admin.php and the id parameter.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2022Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates.CVE-2022-27536 · Other software · Golang · reported by MITREHigh 7.5
Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic.
- Product
- GO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comgroups.google.com
Feb 10, 2022Cross Site Scripting (XSS) vulnerability exists in Piwigo 12.x via the pwg_activity function in include/functions.inc.php.CVE-2021-45357 · Other software · Piwigo · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability exists in Piwigo 12.x via the pwg_activity function in include/functions.inc.php.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2021A Cross Site Scripting (XSS) vulnerability exists in Piwigo 11.5.0 via the system album name and description of the location.CVE-2021-40882 · Other software · Piwigo · reported by MITREMedium 6.1
A Cross Site Scripting (XSS) vulnerability exists in Piwigo 11.5.0 via the system album name and description of the location.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2021Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.CVE-2021-32615 · Other software · Piwigo · reported by MITRECritical 9.8
Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2021archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in whicCVE-2021-27919 · Other software · Golang · reported by MITREMedium 5.5
archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename.
- Product
- GO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgroups.google.comlists.fedoraproject.org
Jan 2, 2021In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension.CVE-2020-28851 · Other software · Golang · reported by MITREHigh 7.5
In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)
- Product
- GO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
Nov 18, 2020Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a CVE-2020-28367 · Other software · Go toolchain · reported by security@golang.orgHigh 7.5
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2020Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in CVE-2020-28366 · Other software · Go toolchain · reported by security@golang.orgHigh 7.5
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2020MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case.CVE-2020-12889 · Other software · Misp · reported by MITRECritical 9.8
MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case.
- Product
- Misp-maltego
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2020Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions andCVE-2020-9402 · Other software · Djangoproject · reported by MITREHigh 8.8
Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.djangoproject.comgroups.google.com
Feb 3, 2020Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django appCVE-2020-7471 · Other software · Djangoproject · reported by MITRECritical 9.8
Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comdocs.djangoproject.com
Sep 16, 2019The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files.CVE-2019-16355 · Other software · Beego · reported by MITREMedium 5.5
The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files.
- Product
- Beego
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2019The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory wCVE-2019-16354 · Other software · Beego · reported by MITREMedium 4.7
The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions.
- Product
- Beego
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2019An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.CVE-2019-14234 · Other software · Djangoproject · reported by MITRECritical 9.8
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgdocs.djangoproject.com
Aug 2, 2019An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.CVE-2019-14235 · Other software · Djangoproject · reported by MITREHigh 7.5
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Aug 2, 2019An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.CVE-2019-14233 · Other software · Djangoproject · reported by MITREHigh 7.5
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Aug 2, 2019An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.CVE-2019-14232 · Other software · djangoblog_project · reported by MITREHigh 7.5
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
- Product
- djangoblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jul 19, 2019Gnome Pango 1.42 and later is affected by: Buffer Overflow.CVE-2019-1010238 · Other software · Gnome · reported by josh@bress.netCritical 9.8
Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.
- Product
- Pango
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jul 1, 2019An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3.CVE-2019-12781 · Other software · Djangoproject · reported by MITREMedium 5.3
An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jun 3, 2019An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2.CVE-2019-12308 · Other software · Djangoproject · reported by MITREMedium 6.1
An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Mar 13, 2019An issue was discovered in net/http in Go 1.11.5.CVE-2019-9741 · Other software · Golang · reported by MITREMedium 6.1
An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command.
- Product
- GO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.