CVE-2022-21455

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: PAM Auth Plugin. Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...

wildfly-core: Invalid Sensitivity Classification of Vault Expression

A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly...

PT-2022-3985 · Cisco · Cisco Webex Meetings

Name of the Vulnerable Software and Affected Versions: Cisco Webex Meetings affected versions not specified Description: The issue is related to multiple vulnerabilities in the web interface of Cisco Webex Meetings, which could allow a remote attacker to conduct a cross-site scripting XSS attack ...

The vulnerability of the Nimbus JOSE + JWT Java library, related to incorrect verification of the cryptographic signature, allows a perpetrator to influence the integrity of the information.

The vulnerability of the Nimbus JOSE + JWT Java library is related to an incorrect verification of the cryptographic signature. Exploiting this vulnerability could allow a malicious actor to influence the integrity of the information...

The vulnerability of the TestEmail function in the Reolink RLC-410W camera’s microprogramming system allows a intruder to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the TestEmail function in the Reolink RLC-410W camera’s microprogramming system is related to memory overflow. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information through...

The vulnerability of the go-getter library, related to the lack of measures to cleanse input data, allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the go-getter library is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the Illumina Local Run Manager software exists due to an incorrect limitation on the path to the restricted access directory. This allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Illumina Local Run Manager software exists due to an incorrect limitation on the path to the restricted access directory. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

OpenJDK: random exponentials issue (Libraries, 8283875)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 17.0.3.1; Oracle GraalVM Enterprise Edition: 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated...

SAP SuccessFactors 安全漏洞

SAP SuccessFactors is a cloud-based hcm software application from SAP, Germany. SAP SuccessFactors suffers from an elevation of privilege vulnerability that stems from an application endpoint misconfiguration. An attacker could use the vulnerability to elevate privileges and read or write...

Memory corruption

JTEKT TOYOPUC PLCs through 2022-04-29 do not ensure data integrity. They utilize the unauthenticated CMPLink/TCP protocol for engineering purposes, including downloading projects and control logic to the PLC. Control logic is downloaded to the PLC on a block-by-block basis with a given memory...

CVE-2022-29958

CVE-2022-29958 affects JTEKT TOYOPUC PLCs up to 2022-04-29, where control logic and projects can be downloaded via unauthenticated CMPLink/TCP without cryptographic authentication. The downloaded code is block-based and executed in the PLC runtime without memory protection, on CPU modules (e.g., ...

CVE-2022-29958

JTEKT TOYOPUC PLCs through 2022-04-29 do not ensure data integrity. They utilize the unauthenticated CMPLink/TCP protocol for engineering purposes, including downloading projects and control logic to the PLC. Control logic is downloaded to the PLC on a block-by-block basis with a given memory...

OpenJDK: random exponentials issue (Libraries, 8283875)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 17.0.3.1; Oracle GraalVM Enterprise Edition: 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated...

PT-2022-4256 · Western Digital · Western Digital My Cloud Web App

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud Web App affected versions not specified Description: The issue is related to the use of a weak SSLContext in the Western Digital My Cloud Web App when configuring port forwarding rules. This weakness is due to the use...

Western Digital My Cloud 安全漏洞

Western Digital My Cloud is a personal cloud storage device from Western Digital. A security vulnerability exists in the Western Digital My Cloud Web App. An attacker could exploit the vulnerability to compromise the integrity, confidentiality, and authenticity of transmitted information...

SAP NetWeaver Enterprise Portal Cross-Site Scripting Vulnerability (CNVD-2022-56956)

SAP NetWeaver Enterprise Portal is a Web front-end component of SAP NetWeaver from SAP Germany. A cross-site scripting vulnerability exists in SAP NetWeaver Enterprise Portal versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50, which stems from a failure to adequately encode user-controlled inp...

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to type mixing errors. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

grub2: Integer underflow in grub_net_recv_ip4_packets

A flaw was found in grub2 when handling IPv4 packets. This flaw allows an attacker to craft a malicious packet, triggering an integer underflow in grub code. Consequently, the memory allocation for handling the packet data may be smaller than the size needed. This issue causes an out-of-bands wri...

CVE-2022-21557

CVE-2022-21557 affects Oracle WebLogic Server (Web Container) on 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. The vulnerability allows a high-privilege attacker with local logon to compromise the server, potentially causing unauthorized data creation/modification/deletion and access to all WebLogic da...

Medium: rust

Issue Overview: A race condition flaw was found in Rust's std::fs::removedirall function. Rust applications that use this function may be vulnerable to a race condition where an unprivileged attacker can trick the application into deleting files and directories, causing an impact on system data...