7869 matches found
D-Link DIR-845 授权问题漏洞
The D-Link DIR-845 is a wireless router from China-based AUO D-Link. A security vulnerability exists in the D-Link DIR845L version A1, which stems from an authentication vulnerability containing an AUTHORIZEDGROUP=1 value...
Cross site scripting
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tptranslation AJAX action, which could allow attackers to make authorised users add a translation. Given the lack of sanitisation in the tk0 parameter, this could lead to a Stored Cross-Site Scriptin...
Double free
Directus is a free and open-source data platform for headless content management. The Directus process can be aborted by having an authorized user update the filenamedisk value to a folder and accessing that file through the /assets endpoint. This vulnerability has been patched and release v9.15....
CVE-2022-36031: Improper Handling of Exceptional Conditions
Directus is a free and open-source data platform for headless content management. The Directus process can be aborted by having an authorized user update the filenamedisk value to a folder and accessing that file through the /assets endpoint. This vulnerability has been patched and release v9.15....
DEBIAN-CVE-2022-26373
Non-transparent sharing of return predictor targets between contexts in some IntelR Processors may allow an authorized user to potentially enable information disclosure via local access...
CVE-2022-26373
Non-transparent sharing of return predictor targets between contexts in some IntelR Processors may allow an authorized user to potentially enable information disclosure via local access...
An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example overwrite the .ssh/authorized_keys file).
...
CVE-2022-30535 NGINX Ingress Controller vulnerability CVE-2022-30535
In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX Ingress Controller. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
UBUNTU-CVE-2022-29154
An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...
CVE-2022-31178 Improper Authorization in eLabFTW
eLabFTW is an electronic lab notebook manager for research teams. A vulnerability was discovered which allows a logged in user to read a template without being authorized to do so. This vulnerability has been patched in 4.3.4. Users are advised to upgrade. There are no known workarounds for this...
Veritas NetBackup 安全漏洞
Veritas NetBackup is a storage service from Veritas, Inc. that is used to provide backup and recovery capabilities for enterprise environments. The software supports the detection of ransomware and backup protection of environmental data such as metadata and virtual environments. A security...
Veritas NetBackup 安全漏洞
Veritas NetBackup is a storage service from Veritas, Inc. that is used to provide backup and recovery capabilities for enterprise environments. The software supports the detection of ransomware and the protection of metadata, virtual environments and other environmental data backup. A security...
grafana: OAuth account takeover
A flaw was found in Grafana. This flaw allows a malicious user with the authorization to log into a Grafana instance via a configured OAuth IdP to take over an existing Grafana account under certain conditions...
grafana: OAuth account takeover
A flaw was found in Grafana. This flaw allows a malicious user with the authorization to log into a Grafana instance via a configured OAuth IdP to take over an existing Grafana account under certain conditions...
Directory Traversal
moodle/moodle is vulnerable to directory traversal. It does not validate the path used to import a lesson question, allowing an authorized user to cause an arbitrary file read via this feature...
CVE-2022-27545
BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page...
CVE-2022-27545 HCL BigFix Web Reports authorized users may perform HTML injection.
BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page...
CVE-2022-27544 HCL BigFix Web Reports authorized users may see sensitive information in clear text
BigFix Web Reports authorized users may see SMTP credentials in clear text...
CVE-2022-27545: Improper Neutralization of Input During Web Page Generation
BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page...
