Slims8 Akasia SQL注入漏洞

Slims8 Akasia is a software of the Slims community in Indonesia. It is used for library resource management e.g. books, journals, digital documents and other library materials and administration.An SQL injection vulnerability exists in Slims8 Akasia version 8.3.1, which stems from missing SQL...

CVE-2021-45792: Improper Neutralization of Input During Web Page Generation

Slims9 Bulian 9.4.2 is affected by Cross Site Scripting XSS in /admin/modules/system/customfield.php...

PT-2022-12409

Name of the Vulnerable Software and Affected Versions Slims9 Bulian version 9.4.2 Description The issue is related to Cross Site Scripting XSS in the "/admin/modules/system/custom field.php" API endpoint. This affects the ability to securely manage custom fields within the system. Recommendations...

PT-2022-12411

Name of the Vulnerable Software and Affected Versions Slims9 Bulian version 9.4.2 Description The issue affects the "/admin/modules/system/backup.php" API endpoint, allowing SQL injection attacks. This can result in the unauthorized obtainment of user data. Recommendations For Slims9 Bulian versi...

Huawei Emui and Magic UI Bastet modules have unspecified vulnerabilities

Huawei Emui is a mobile operating system developed on Android.Magic Ui is a mobile operating system developed on Android.Huawei Emui and Magic UI Bastet modules have a security vulnerability that can be exploited by attackers to compromise the integrity...

azureml-designer-classic-modules (>=0.0.127, <=0.0.129), azureml-designer-cv-modules (>=0.0.8, <=0.0.10) +17 more potentially affected by CVE-2022-24303 via pillow (7.1.0)

pillow PYPI version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - azureml-designer-classic-modules =0.0.127, =0.0.8, =0.0.10, =0.0.7, =0.0.7, =0.0.2, =0.3.1, =0.1.1, =0.0.2, =0.0.1, =0.0.4, =0.0.3, =0.1.0 - qweb...

Qakbot Botnet Sprouts Fangs, Injects Malware into Email Threads

The Qakbot botnet is getting more dangerous, sinking its fangs into email threads and injecting malicious modules to pump up the core botnet’s powers. On Thursday, Sophos published a deep dive into the botnet, describing how researchers have recently seen it spreading through email thread hijacki...

HUAWEI EMUI和Honor Magic Ui 安全漏洞

Huawei Emui is a mobile operating system developed on Android. Magic Ui is a mobile operating system developed on Android. Huawei Emui and Magic UI Wi-Fi modules have a privilege control vulnerability that could be exploited by attackers to obtain sensitive information...

Huawei EMUI和Huawei Magic UI 安全漏洞

Huawei Emui is a mobile operating system developed on Android. magic Ui is a mobile operating system developed on Android. Huawei Emui and Magic UI Nearby modules are vulnerable to authorization issues that could be exploited by attackers to compromise availability and integrity...

[slackware-security] Slackware 15.0 kernel

New kernel packages are available for Slackware 15.0 to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/linux-5.15.27/: Upgraded. These updates fix various bugs and security issues, including the recently announced "Dirty Pipe" vulnerability which...

CVE-2022-25471

An Insecure Direct Object Reference IDOR vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zendmodules/public/Installer/register...

PT-2022-17317

Name of the Vulnerable Software and Affected Versions OpenEMR version 6.0.0 Description The issue is related to an Insecure Direct Object Reference IDOR vulnerability. It allows any authenticated attacker to access and modify unauthorized areas. This can be achieved by sending a crafted POST...

CVE-2022-25471: Authorization Bypass Through User-Controlled Key

An Insecure Direct Object Reference IDOR vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zendmodules/public/Installer/register...

Nvidia GPU Display Driver for Linux拒绝服务漏洞

Nvidia GPU Display Driver for Linux is a driver for interactive support of graphics modules on Linux systems from Nvidia, Inc. A denial-of-service vulnerability exists in the Nvidia GPU Display Driver for Linux kernel driver package, which can be exploited by attackers to The vulnerability can be...

DRUPAL-CONTRIB-2022-027

The GOV.UK Theme govuktheme is a Drupal theme for the GOV.UK Design System. The theme doesn't sanitize user input in certain cases, which leads to Cross-Site-Scripting XSS vulnerabilities. An attacker that can create or edit certain entities or configuration may be able to exploit one or more...

microweber has an unspecified vulnerability (CNVD-2022-13203)

Microweber is an online store management system from the US Microweber community that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. Microweber has a security vulnerability, and no details of the vulnerability are available at this time...

Cobbler Command Injection Vulnerability (CNVD-2022-18324)

Cobbler is a network installation server suite that is primarily used to quickly set up Linux network installations. A command injection vulnerability exists in versions of Cobbler prior to 3.3.1, stemming from the checkforinvalidimports function in the templar.py file, which allows Cheetah code ...

Privilege Escalation

cobbler is vulnerable to privilege escalation. The vulnerability exists due to the lack of template sanitization in the checkforinvalidimports function of templar.py, allowing Cheetah code to import Python modules without permission...

GHSA-6CM4-GM85-972C Command Injection in Cobbler

An issue was discovered in Cobbler through 3.3.0. In the templar.py file, the function checkforinvalidimports can allow Cheetah code to import Python modules via the "from MODULE import" substring. Only lines beginning with import are blocked...

Improper Neutralization of Special Elements used in a Command ('Command Injection')

An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function checkforinvalidimports can allow Cheetah code to import Python modules via the from MODULE import substring. Only lines beginning with import are blocked...