CVE-2022-4322

The CVE-2022-4322 issue affects maku-boot up to version 2.2.0, specifically the Scheduled Task Handler’s doExecute function, where manipulation leads to injection. Remote exploitation is possible and the exploit has been disclosed publicly. The patch to fix this is named 446eb7294332efca2bfd791bc...

CVE-2022-3856 Comic Book Management System < 2.2.0 - Admin+ SQLi

The Comic Book Management System WordPress plugin before 2.2.0 does not sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin...

SICK SIM Series 访问控制错误漏洞

SICK SIM Series is a series of sensor integrators from SICK, Germany. An access control error vulnerability exists in SICK SIM Series 1012 Partnumber 1098146 versions prior to 2.2.0. An attacker accesses a user level defined as RecoverableUserLevel by invoking the password recovery mechanism meth...

PT-2022-27058 · Sick · Sick Sim1012

Name of the Vulnerable Software and Affected Versions: SICK SIM1012 Partnumber 1098146 versions prior to 2.2.0 Description: A password recovery issue allows an unprivileged remote attacker to gain access to the RecoverableUserLevel by invoking the password recovery mechanism method, leading to...

Command injection

XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks...

PT-2022-23159 · Sftpgo · Sftpgo

Name of the Vulnerable Software and Affected Versions: SFTPGo versions 2.2.0 through 2.3.3 Description: SFTPGo is a configurable SFTP server with optional HTTP/S, FTP/S, and WebDAV support. It supports login using TOTP Time-based One Time Passwords as a secondary authentication factor and also...

CVE-2022-36579

Wellcms 2.2.0 is vulnerable to Cross Site Request Forgery CSRF...

CVE-2022-36579

CVE-2022-36579 affects Wellcms 2.2.0 and is described as a Cross-Site Request Forgery (CSRF) vulnerability. The NVD entry assigns CVSSv3.1 base score 8.8 (HIGH) with an attack vector of Network, low attack complexity, privileges required NONE, and user interaction required, indicating a high-impa...

CVE-2022-36579

Wellcms 2.2.0 is vulnerable to Cross Site Request Forgery CSRF...

CVE-2022-36579

Wellcms 2.2.0 is vulnerable to Cross Site Request Forgery CSRF...

WordPress plugin Coming Soon Landing Page 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2022-23483 · Wellcms · Wellcms

Name of the Vulnerable Software and Affected Versions: Wellcms version 2.2.0 Description: The issue is related to Cross Site Request Forgery CSRF, which is a type of attack that tricks a user into performing unintended actions on a web application. Recommendations: For Wellcms version 2.2.0, as a...

CVE-2022-35980 OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information

OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Versions 2.0.0.0 and 2.1.0.0 of the security plugin are affected by an information disclosure vulnerability. Requests to an OpenSearch cluster configured with advanced access control features...

GHSA-F4QR-F4XX-HJXW OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information

Impact Requests to an OpenSearch cluster configured with advanced access control features document level security DLS, field level security FLS, and/or field masking will not be filtered when the query's search pattern matches an aliased index. OpenSearch Dashboards creates an alias to .kibana by...

Cockpit Access Control Error Vulnerability

Cockpit is an interactive server management interface. An access control error vulnerability exists in Cockpit versions prior to 2.2.0 that stems from insufficient session expiration. An attacker could exploit the vulnerability to take control of an account using expired session credentials...

Cockpit before 2.2.0 vulnerable to Insufficient Session Expiration

Cockpit before version 2.2.0 is vulnerable to Insufficient Session Expiration. The application does not validate requests after password changes, allowing a user to change their account details even after an admin changes their password...

CVE-2022-2713

Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0...

PT-2022-18527 · Synology · Synology Usb Copy

Name of the Vulnerable Software and Affected Versions: Synology USB Copy versions prior to 2.2.0-1086 Description: The issue is related to a Path Traversal vulnerability in the webapi component, allowing remote authenticated users to read or write arbitrary files via unspecified vectors...

Synology USB Copy 路径遍历漏洞

Synology USB Copy from Synology China helps you copy files between Synology NAS and external USB/SD storage devices. A path traversal vulnerability exists in Synology USB Copy versions prior to 2.2.0-1086, which stems from an improper restriction on the pathname of a restricted directory in the...

Jenkins Repository Connector Plugin 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...