CVE-2022-25168

Apache Hadoop's FileUtil.unTarFile, File API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in...

The vulnerability of the Add Photo and Import Staff functions in the school management web system School ERP Pro allows a perpetrator to execute arbitrary codes.

The vulnerability of the Add Photo and Import Staff functions in the school management web system School ERP Pro relates to the unlimited loading of dangerous files. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code by loading a specially created malware file...

PT-2022-3981

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions prior to 2.10.2 Apache Hadoop versions prior to 3.2.4 Apache Hadoop versions prior to 3.3.3 Description The issue is related to the FileUtil.unTarFile, File API in Apache Hadoop, which does not escape the input file name...

Error: "Invalid connection address" when adding XenServer host connection

The following error is seen when attempting to add a Citrix Hypervisor XenServer hosting connection: Error Id: XDDS:49D3D465 Exception: Citrix.Console.Models.Exceptions.ScriptException Invalid connection address. Check that the address is valid and that it references a host in the XenServer pool...

TCL LinkHub Mesh Wi-Fi OS Command Injection Vulnerability

TCL LinkHub Mesh Wi-Fi is a router from TCL Corporation.TCL LinkHub Mesh Wi-Fi is vulnerable to an operating system command injection vulnerability that originates in the confsrv ucloudaddnode function and can be exploited by attackers to cause arbitrary command execution...

TCL LinkHub Mesh Wi-Fi 操作系统命令注入漏洞

TCL LinkHub Mesh Wi-Fi is a router from TCL. An OS command injection vulnerability exists in TCL LinkHub Mesh Wi-Fi MS1G0001.0014 version, which stems from an os command injection vulnerability in the confsrv ucloudaddnewnode function. An attacker could exploit this vulnerability by sending...

TCL LinkHub Mesh Wi-Fi 缓冲区错误漏洞

TCL LinkHub Mesh Wi-Fi is a router from TCL. A buffer error vulnerability exists in TCL LinkHub Mesh Wi-Fi version MS1G0001.0014, which stems from a stack-based buffer overflow vulnerability in the confer ucloudaddnodenew function...

TCL LinkHub Mesh Wi-Fi 操作系统命令注入漏洞

TCL LinkHub Mesh Wi-Fi is a router from TCL Corporation.TCL LinkHub Mesh Wi-Fi is vulnerable to an operating system command injection vulnerability that originates in the confsrv ucloudaddnode function and can be exploited by attackers to cause arbitrary command execution...

WordPress plugin Transposh WordPress Translation 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin Transposh WordPress...

CVE-2022-32119

Arox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload vulnerabilities via the Add Photo function at photogalleries.inc.php and the import staff excel function at 1financemaster.inc.php...

CVE-2022-32119

Arox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload vulnerabilities via the Add Photo function at photogalleries.inc.php and the import staff excel function at 1financemaster.inc.php...

EUVD-2022-53368

Arox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload vulnerabilities via the Add Photo function at photogalleries.inc.php and the import staff excel function at 1financemaster.inc.php...

CVE-2022-32274

The Transition Scheduler add-on 6.5.0 for Atlassian Jira is prone to stored XSS via the project name to the creation function...

CVE-2022-32274

The CVE-2022-32274 entry concerns the Transition Scheduler add-on 6.5.0 for Atlassian Jira, with a stored XSS vulnerability that can be triggered via the project name during the creation function. The issue is documented across multiple sources (e.g., NVD description). Reported impact indicates p...

Experts Uncover 350 Browser Extension Variants Used in ABCsoup Adware Campaign

A malicious browser extension with 350 variants is masquerading as a Google Translate add-on as part of an adware campaign targeting Russian users of Google Chrome, Opera, and Mozilla Firefox browsers. Mobile security firm Zimperium dubbed the malware family ABCsoup, stating the "extensions are...

The vulnerability of the OAS Engine SecureAddUser function in the platform for data transmission between devices and applications allows a perpetrator to gain unauthorized access to the system.

The vulnerability of the OAS Engine SecureAddUser function on the platform for data transfer between devices and applications is related to the lack of authentication checks for this critical function. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized...

Design/Logic Flaw

The Appfire Jira Misc Custom Fields JMCF app 2.4.6 for Atlassian Jira allows XSS via a crafted project name to the Add Auto Indexing Rule function...

Zoo Management System Cross-Site Scripting Vulnerability

PHPGURUKUL Zoo Management System is a zoo management system by Phpgurukul team. A cross-site scripting vulnerability exists in Zoo Management System v1.0, which stems from a lack of checksum filtering of user-supplied data and output in the Add Category feature. The vulnerability can be exploited...

CVE-2022-33075

A stored cross-site scripting XSS vulnerability in the Add Classification function of Zoo Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via unspecified vectors...

CVE-2022-33075

A stored cross-site scripting XSS vulnerability in the Add Classification function of Zoo Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via unspecified vectors...