15633 matches found
SolarWinds Platform 代码问题漏洞
SolarWinds Platform is a unified monitoring, observability, and service management platform from U.S.-based SolarWinds, Inc. A security vulnerability exists in SolarWinds Platform that stems from vulnerability to deserialization of untrustworthy data and allows a remote attacker with valid access...
WordPress Plugin Betheme them plugin deserialization vulnerability
WordPress is a blogging platform developed in PHP by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress theme is a theme for WordPress. A deserialization vulnerability exists in WordPress Plugin Betheme them plugin 26.5.1.4 and...
D-Link DIR-816 Command Injection (CVE-2022-37130)
A command injection vulnerability exists in D-Link DIR-816. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...
Doufox Arbitrary File Upload (CVE-2022-38621)
An arbitrary file upload vulnerability exists in Doufox. Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the vulnerable system with administrative privileges...
Event Registration App CSV Injection Vulnerability
Event Registration App is a JavaScript application for registering event participants by Carlo Montero Personal Developer. A CSV injection vulnerability exists in Carlo Montero Event Registration App v1.0, which stems from improper use of the formula elements of the First Name, Contact, and Remar...
D-Link DIR-3060 Buffer Overflow Vulnerability
D-Link DIR-3060 is a router from China Friendship Communications D-Link Inc. It provides a function to connect to the network.The D-Link DIR-3060 DIR3060A1FW111B04.bin version contains a buffer overflow vulnerability, which stems from a boundary error in FUN0049ac18 when handling untrusted input....
Cross-site Scripting (XSS)
dokuwiki is vulnerable to cross-site scripting. The vulnerability exists via the function generateFilename which allows an attacker to inject and execute arbitrary javascript...
PT-2022-5603 · Aveva · Aveva Edge
Name of the Vulnerable Software and Affected Versions: AVEVA Edge formerly InduSoft Web Studio versions R2020 and prior Description: An issue was discovered in the ExecuteCommand function that allows unauthenticated arbitrary commands to be executed. This is related to errors in access control...
CVE-2022-39070
There is an access control vulnerability in some ZTE PON OLT products. Due to improper access control settings, remote attackers could use the vulnerability to log in to the device and execute any operation...
CVE-2022-3861 Betheme <= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection
The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import parameters passed through the mfnbuilderimport, mfnbuilderimportpage,...
CVE-2022-45017
A cross-site scripting XSS vulnerability in the Overview Page settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Loop field...
CVE-2022-42904
Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings...
PT-2022-36776 · Git +1 · Fluent-Bit
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-use-after-free error, which occurs when the program attempts to access memory that has already been freed. The crash state...
CVE-2022-42904
Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings...
CVE-2022-43192
An arbitrary file upload vulnerability in the component /dede/filemanagecontrol.php of Dedecms v5.7.101 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerability is related to an incomplete fix for CVE-2022-40886...
CVE-2022-43234
An arbitrary file upload vulnerability in the /attachments component of Hoosk v1.8 allows attackers to execute arbitrary code via a crafted PHP file...
Design/Logic Flaw
An arbitrary file upload vulnerability in the /attachments component of Hoosk v1.8 allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2022-43234
An arbitrary file upload vulnerability in the /attachments component of Hoosk v1.8 allows attackers to execute arbitrary code via a crafted PHP file...
Synology DiskStation Manager (DSM) 6.2.x < 6.2.3-25426-3 Multiple Vulnerabilities (Synology-SA-20:26) - Remote Known Vulnerable Versions Check
Synology DiskStation Manager DSM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...