Vulnerabilidades

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.

Certain HP LaserJet Pro print products are potentially vulnerable to Heap Overflow and/or Remote Code Execution.

Certain DesignJet and PageWide XL TAA compliant models may have risk of potential information disclosure if the hard disk drive is physically removed from the printer.

Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Remote Code Execution.

Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Elevation of Privilege.

A potential security vulnerability has been identified in the system BIOS for certain HP PC products which may allow loss of integrity. HP is releasing firmware updates to mitigate the potential vulnerability.

OURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.

OURPHP <= 7.2.0 is vulnerable to SQL Injection.

OURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via ourphp_tz.php.

CLTPHP <=6.0 is vulnerable to Improper Input Validation via application/admin/controller/Template.php.

CLTPHP <=6.0 is vulnerable to Cross Site Scripting (XSS) via application/home/controller/Changyan.php.

CLTPHP <=6.0 is vulnerable to Unrestricted Upload of File with Dangerous Type.

CLTPHP <=6.0 is vulnerable to Directory Traversal.

HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens

An HPE OneView appliance dump may expose SNMPv3 read credentials

An HPE OneView appliance dump may expose FTP credentials for c7000 Interconnect Modules

An HPE OneView appliance dump may expose SAN switch administrative credentials

An HPE OneView appliance dump may expose OneView user accounts

An HPE OneView appliance dump may expose proxy credential settings

Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the start or end of a header key or value, can cause an invalid…

Cross-Site Request Forgery (CSRF) vulnerability in Nicolas Zeh PHP Execution plugin <= 1.0.0 versions.

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild…

La opción "Migrate server hardware" de los appliance virtuales HPE OneView puede exponer información sensible en un HPE volcado de soporte de OneView.

An HPE OneView Global Dashboard (OVGD) appliance dump may expose OVGD user account credentials