Spitfire CMS 1.0.475 PHP Object Injection Vulnerability

Spitfire CMS version 1.0.475 is prone to a PHP object injection vulnerability due to the unsafe use of unserialize function. A potential attacker, authenticated, could exploit this vulnerability by sending specially crafted requests to the web application containing malicious serialized input...

sdk-server: Denial of Service

A flaw was found in the Eclipse Milo SDK Server. This flaw allows an attacker to consume the application memory, leading to a denial of service by sending specific requests...

PT-2022-6093 · Fortinet · Fortiadc

Name of the Vulnerable Software and Affected Versions: Fortinet FortiADC versions 6.2.4 and below Fortinet FortiADC versions 7.0.0 through 7.0.2 Fortinet FortiADC version 7.1.0 Description: The issue is related to improper input validation, allowing an authenticated attacker to retrieve files wit...

Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations

A flaw was found in Undertow with EJB invocations. This flaw allows an attacker to generate a valid HTTP request and send it to the server on an established connection after removing the LASTCHUNK from the bytes, causing a denial of service...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to circumvent security restrictions and increase their privileges.

The vulnerability of the Cisco Identity Services Engine ISE web management interface is related to the failure to take measures to neutralize special elements used in the OS command line. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and enhance their...

The vulnerability in the web interface of the Cisco DNA Center allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Cisco DNA Center’s web interface is related to errors in processing requests. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information by sending specially crafted requests...

Moodle 代码问题漏洞

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from a security vulnerability that stems from insufficient validation of user-supplied input. An attacker exploiting thi...

FileCloud 安全漏洞

FileCloud is an ultra-secure content collaboration platform from US-based FileCloud, Inc. offering industry-leading compliance, data governance, data leakage protection, data retention and digital rights management capabilities. A security vulnerability exists in FileCloud version 20.2 and later...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to upload arbitrary files.

The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform relates to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to upload arbitrary files by sending specially crafted HTTP requests...

CVE-2022-44641

In Linaro Automated Validation Architecture LAVA before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive use of memory on the server and a Denial of Service...

The vulnerability in the web interface of the Cisco BroadWorks CommPilot Application Software allows a attacker to perform an SSRF attack.

The vulnerability of the Cisco BroadWorks CommPilot Application Software’s web interface is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack using a specially crafted HTTP request...

The vulnerability of the API interface of the Cisco Meeting Server platform allows a hacker to trigger a service failure.

The vulnerability of the Cisco Meeting Server’s API interface relates to insufficient validation of input data during request processing. Exploiting this vulnerability allows a malicious actor to cause service failures by sending specially crafted requests...

The vulnerability of the indexOf() function in the JSONParserByteArray class of the JSONSmart library allows a attacker to cause a service failure.

The vulnerability of the indexOf function in the JSONParserByteArray class of the JSON Smart library is related to the occurrence of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures by sending specially crafted web...

The vulnerability of the SimpleEvaluationContext class in the Spring Data Commons data management platform and the Spring Data REST framework for creating web services allows a attacker to execute arbitrary code.

The vulnerability of the SimpleEvaluationContext class in the Spring Data Commons data management platform and the Spring Data REST web framework is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending specially...

PT-2022-26123 · Arches · Arches

Name of the Vulnerable Software and Affected Versions: Arches versions prior to 6.1.2 Arches versions prior to 6.2.1 Arches versions prior to 7.1.2 Description: The issue allows an attacker to execute unwanted SQL statements against the database with a carefully crafted web request. Users are...

CVE-2022-29481

A leftover debug code vulnerability exists in the console nvram functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network requests can lead to disabling security features. An attacker can send a sequence of requests to trigger this vulnerability...

CVE-2022-26023

A leftover debug code vulnerability exists in the console verify functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network requests can lead to disabling security features. An attacker can send a sequence of requests to trigger this vulnerability...

The vulnerability of the microprogramming software of the Cisco TelePresence Collaboration Endpoint conference call control device and the Cisco RoomOS operating system, related to deficiencies in access control, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the microprogramming software of the Cisco TelePresence Collaboration Endpoint conference call control device and the Cisco RoomOS operating system is related to deficiencies in access control. Exploiting this vulnerability can allow an intruder to gain unauthorized access to...

PT-2022-5454 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to errors in synchronization when using a shared resource in the implementation of the Point-to-Point Tunneling Protocol PPTP in Windows operating systems. This can be...

IBM InfoSphere Information Server Operating System Command Injection Vulnerability

IBM InfoSphere Information Server is a data integration platform from International Business Machines IBM, Inc. IBM InfoSphere Information Server version 11.7 contains an operating system command injection vulnerability that can be exploited by a locally authenticated attacker to execute arbitrar...