CVE-2022-29613

Due to insufficient input validation, SAP Employee Self Service allows an authenticated attacker with user privileges to alter employee number. On successful exploitation, the attacker can view personal details of other users causing a limited impact on confidentiality of the application...

PT-2022-19726

Name of the Vulnerable Software and Affected Versions SAP Employee Self Service affected versions not specified Description The issue is caused by insufficient input validation in SAP Employee Self Service, allowing an authenticated attacker with user privileges to alter employee numbers...

UniverSIS UniverSIS-API SQL注入漏洞

UniverSIS UniverSIS-API is a student information system architecture interface. A remote attacker could use this vulnerability to retrieve personal information or change grades by sending a crafted SQL statement...

PT-2022-16881

Name of the Vulnerable Software and Affected Versions C1 CMS versions prior to 6.12 Description The issue allows an authenticated user to exploit Server Side Request Forgery SSRF by causing the server to make arbitrary GET requests to other servers in the local network or on localhost. This can...

CVE-2022-0715

A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and used to upload malicious firmware. Affected Product: APC Smart-UPS Family: SMT Series SMT Series ID=18: UPS 09.8 and prior / SMT Series...

PT-2022-13091

Name of the Vulnerable Software and Affected Versions AnyComment WordPress plugin versions prior to 0.2.18 Description The issue is related to a race condition that occurs when liking or disliking a comment or reply. This could allow any authenticated user to quickly increase their own rating or...

Updated mariadb packages fix security vulnerability

InnoDB - --skip-symbolic-links does not disallow .isl file creation MDEV-26870 - Indexed CHAR columns are broken with NOPAD collations MDEV-25440 - insert-intention lock conflicts with waiting ORDINARY lock MDEV-27025 - Crash recovery improvements MDEV-26784, MDEV-27022, MDEV-27183, MDEV-27610...

PT-2022-6482 · Zabbix +2 · Zabbix +2

Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: The issue is related to the lack of protection of the web page structure in Zabbix. An authenticated user can create a link with reflected Javascript code inside it for the services' page an...

CVE-2021-45335

Sandbox component in Avast Antivirus prior to 20.4 has an insecure permission which could be abused by local user to control the outcome of scans, and therefore evade detection or delete arbitrary system files...

PT-2021-14285

Name of the Vulnerable Software and Affected Versions: EC-CUBE 2 series versions 2.11.2 through 2.17.1 Description: The issue concerns improper access control in the Management screen, allowing a remote authenticated attacker to bypass access restrictions and alter System settings. Recommendation...

CVE-2021-20841: Undefined Security Weakness

Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors...

PT-2021-22879 · Unknown · Climatix Pol909

Name of the Vulnerable Software and Affected Versions: Climatix POL909 AWB module versions prior to V11.42 Climatix POL909 AWM module versions prior to V11.34 Description: A vulnerability has been identified where the web server of affected devices transmits data without TLS encryption. This coul...

CVE-2021-38450: Improper Control of Generation of Code

The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software...

PHP 缓冲区错误漏洞

PHP is a scripting language that executes on the server side. PHP suffers from a buffer error vulnerability that could allow an attacker to bypass PHP's access restrictions via FPM in order to read or alter data...

CVE-2021-20802

HTTP header injection vulnerability in Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote attacker to alter the information stored in the product...

PT-2021-14277

Name of the Vulnerable Software and Affected Versions: SNKRDUNK Market Place App for iOS versions prior to 2.2.0 Description: The issue allows man-in-the-middle attackers to eavesdrop on and/or alter encrypted communication via a crafted certificate, due to improper server certificate verificatio...

PT-2021-14256

Name of the Vulnerable Software and Affected Versions: Cybozu Remote Service versions 3.1.8 through 3.1.9 Description: The issue allows a remote attacker to alter the information stored in the product due to an HTTP header injection vulnerability. Recommendations: For Cybozu Remote Service versio...

UBUNTU-CVE-2021-22930

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior...

Teleport has an unspecified vulnerability (CNVD-2022-18316)

Teleport is an identity-aware, multi-protocol access agent from Teleport USA, Inc. Used by engineers and security professionals to unify access to SSH servers, Kubernetes clusters, web applications, and databases across all environments, Teleport has a security vulnerability that could be exploit...

Microsoft Office 信息泄露漏洞

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of the product include Word, Excel, Access, Powerpoint, FrontPage, and so on. A security vulnerability exists in Microsoft Office version 2.8, which stems from a flaw in th...