Security Bulletin: IBM Jazz for Service Management is vulnerable to a Apache Log4j vulnerabilities(CVE-2021-45105, CVE-2021-45046)

Summary Based on current information and analysis, IBM Jazz for Service Management does not use Apache log4j-core library which is vulnerable to CVE-2021-45105, CVE-2021-45046 . However, IBM Jazz for Service Management may be impacted because the old version of Log4j-1.2-api and Log4j-api are use...

PT-2022-11729 · Totolink · Totolink Ex1200T

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX1200T version 4.1.2cu.5215 Description: The issue concerns a remote command injection vulnerability. It is located in the setDeviceMac function of the global.so file, allowing control over the deviceName to launch an attack...

GHSA-RM24-25XM-9454 Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution

An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window...

Apple macOS Big Sur 缓冲区错误漏洞

Apple macOS Big Sur is a U.S. Apple Apple macOS Big Sur is the 17th major release of macOS, the operating system used by Apple for the MAC. Apple macOS Big Sur suffers from a buffer error vulnerability that originates from a boundary error in SMB. A remote attacker can exploit this vulnerability ...

PT-2022-18083 · Unknown · Inrouter302

Name of the Vulnerable Software and Affected Versions: InRouter302 version 3.5.4 Description: The issue is related to improper input validation vulnerabilities in the libnvram.so nvram import functionality and the httpd's user define set item function. A specially-crafted file can lead to remote...

Security Bulletin: IBM Sterling Order Management Apache Struts vulnerablity

Summary IBM Sterling Order Management Apache Struts vulnerablity Vulnerability Details CVEID:CVE-2019-0233 DESCRIPTION: Apache Struts is vulnerable to a denial of service, caused by an access permission override when performing a file upload. By sending a specially crafted request, an attacker...

Progress Software WhatsUp Gold 安全漏洞

Progress Software WhatsUp Gold is a network monitoring software from Progress Software, Inc. It is used to monitor the entire network infrastructure as well as applications, configurations and network traffic. A security vulnerability exists in Progress Software WhatsUp Gold versions 21.1.0 throu...

PT-2022-19303 · Totolink · Totolink N600R

Name of the Vulnerable Software and Affected Versions: TOTOLink N600R version V5.3c.7159 B20190425 Description: A command injection issue was discovered via the ipdoamin parameter in the "/setting/setDiagnosisCfg" API endpoint. Recommendations: For TOTOLink N600R version V5.3c.7159 B20190425, as ...

Discourse 2.9.x < 2.9.0.beta4 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...

PT-2022-10453 · Solarwinds · Serv-U

Name of the Vulnerable Software and Affected Versions: Serv-U versions 15.3.0.X through 15.3.0.X before Hotfix 1 Serv-U version 15.3 Description: A researcher reported a Directory Transversal issue in Serv-U. This may allow access to files relating to the Serv-U installation and server files. The...

AZL-26757 CVE-2022-27404 affecting package qt5-qtbase for versions less than 5.15.9-1

FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfntinitface...

ALPINE-CVE-2022-21427

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: FTS. Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2022-21420

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence...

PT-2022-2419 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.28 and prior Description: The issue exists due to insufficient input validation in the MySQL Server component, specifically in the Server: Replication subsystem. This allows a remote attacker with high privileges and...

ZOHO ManageEngine OpManager SQL注入漏洞

ZOHO ManageEngine OpManager is a comprehensive network monitoring software from ZOHO USA. A SQL injection vulnerability exists in versions prior to ZOHO ManageEngine OpManager 125588 and 125603, which stems from a problem in the inventory reporting module. An attacker could use this vulnerability...

Verizon 4G LTE Network Extender 0.4.038.2131 Weak Credential Algorithm Exploit

Verizon's 4G LTE Network Extender is utilizing a weak default admin password generation algorithm. The password is generated using the last 4 values from device's MAC address which is disclosed on the main webUI login page to an unauthenticated attacker. The values are then concatenated with the...

PT-2022-17926 · Tenda · Tenda M3

Name of the Vulnerable Software and Affected Versions: Tenda M3 version 1.10 V1.0.0.124856 Description: A command injection issue was found in the component "/goform/setFixTools" API endpoint. Recommendations: For version 1.10 V1.0.0.124856, consider restricting access to the "/goform/setFixTools...

PT-2022-18204 · Tenda · Tenda M3

Name of the Vulnerable Software and Affected Versions: Tenda M3 version 1.10 V1.0.0.124856 Description: A command injection issue was found in the component "/goform/delAd" of the affected software. Recommendations: For version 1.10 V1.0.0.124856, consider restricting access to the "/goform/delAd...

PT-2022-18205 · Tenda · Tenda M3

Name of the Vulnerable Software and Affected Versions: Tenda M3 version 1.10 V1.0.0.124856 Description: A command injection issue was found in the /cgi-bin/uploadWeiXinPic component. Recommendations: For Tenda M3 version 1.10 V1.0.0.124856, consider restricting access to the...

PT-2022-2360 · Kingsoft · Kingsoft Wps Office

Name of the Vulnerable Software and Affected Versions: Kingsoft WPS Office versions 11.2.0.10382 and earlier Description: The issue is related to the wpsupdater.exe file in Kingsoft WPS Office, which allows remote code execution by modifying the HKEY CURRENT USER in the registry. This is due to...