U.S. Dept Of Defense: Sql Injection At █████████

Description: Hi Security Team I Hope You Are Doing Well Sql Injection is a common attack vector that uses malicious SQL code for backend database manipulation to access information that was not intended to be displayed. 1: Visit This Endpoint https://█████/ As You Can See This Website Using Asp.n...

CVE-2022-40886

DedeCMS 5.7.98 has a file upload vulnerability in the background...

CVE-2022-41082

Microsoft Exchange Server Remote Code Execution Vulnerability Recent assessments: zeroSteiner at January 10, 2023 2:58pm UTC reported: CVE-2022-41082, also known as ProxyNotShell is an authenticated RCE in Microsoft Exchange. ProxyNotShell actually combines CVE-2022-41082 and CVE-2022-41040 for t...

Zoo Management System save_event Arbitrary File Upload Vulnerability

Zoo Management System is a zoo management system. It provides an online and automated platform for zoo organizations to manage their daily records. An arbitrary file upload vulnerability exists in Zoo Management System v1.0, which arises from a lack of validation of uploaded files at the image...

gitea -- multiple issues

The Gitea team reports: Sanitize and Escape refs in git backend Bump golang.org/x/text Update bluemonday...

CVE-2022-40924

Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "saveanimal" file of the "Animals" module in the background management system...

PT-2022-25622

Name of the Vulnerable Software and Affected Versions Zoo Management System version 1.0 Description The issue is related to an arbitrary file upload vulnerability in the picture upload point of the "save animal" file of the "Animals" module in the background management system. Recommendations For...

Ubuntu 22.04 LTS : Linux kernel (Oracle) vulnerabilities (USN-5640-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5640-1 advisory. It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of-...

CVE-2022-39225

Parse Server contains a vulnerability (CVE-2022-39225) where a user can write to another user’s session object if the session object ID is known, potentially reading custom fields. The issue affects older releases prior to 4.10.15 and 5.0.0–5.2.6, with patches in 4.10.15+ and 5.2.6+. Mitigation g...

EulerOS Virtualization 2.9.1 : openldap (EulerOS-SA-2022-2358)

According to the versions of the openldap packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend...

CVE-2022-39956

The OWASP ModSecurity Core Rule Set CRS is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and...

Design/Logic Flaw

The OWASP ModSecurity Core Rule Set CRS is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and...

CVE-2022-39956

The OWASP ModSecurity Core Rule Set CRS is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and...

CVE-2022-39955

The OWASP ModSecurity Core Rule Set CRS is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indicates multiple character encoding schemes. A vulnerable back-end can potentially be exploited by declaring multiple Content-Type "charset" nam...

CVE-2022-39955 Partial rule set bypass in OWASP ModSecurity Core Rule Set by submitting a specially crafted HTTP Content-Type header

The OWASP ModSecurity Core Rule Set CRS is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indicates multiple character encoding schemes. A vulnerable back-end can potentially be exploited by declaring multiple Content-Type "charset" nam...

CVE-2022-39956

The OWASP ModSecurity Core Rule Set CRS is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and...

CVE-2022-39955

This CVE concerns the OWASP ModSecurity Core Rule Set (CRS) with a partial rule set bypass caused by a specially crafted HTTP Content-Type header that signals multiple charset encodings. A vulnerable backend could bypass CRS Content-Type charset allow lists, allowing an encoded payload to bypass ...

CVE-2022-39956 Partial rule set bypass in OWASP ModSecurity Core Rule Set for HTTP multipart requests using character encoding in the Content-Type or Content-Transfer-Encoding header

The OWASP ModSecurity Core Rule Set CRS is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and...

CVE-2022-39955

The OWASP ModSecurity Core Rule Set CRS is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indicates multiple character encoding schemes. A vulnerable back-end can potentially be exploited by declaring multiple Content-Type "charset" nam...

Shopware contains sensitive data in backend customer module

Impact The request for the customer detail view in the backend administration contained sensitive data like the hashed password and the session ID. Patches We recommend updating to the current version 5.7.15. You can get the update to 5.7.15 regularly via the Auto-Updater or directly via the...