CVE-2022-4619: Improper Neutralization of Input During Web Page Generation

The Sidebar Widgets by CodeLights plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Extra CSS class’ parameter in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2022-27793

Name of the Vulnerable Software and Affected Versions The Sidebar Widgets by CodeLights plugin for WordPress versions up to, and including, 1.4 Description The issue is related to Stored Cross-Site Scripting via the Extra CSS class parameter due to insufficient input sanitization and output...

CVE-2022-46689

A race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. An app may be able to execute arbitrary code with kernel privileges...

CVE-2022-3359: Undefined Security Weakness

The Shortcodes and extra features for Phlox theme WordPress plugin before 2.10.7 unserializes the content of an imported file, which could lead to PHP object injection when a user imports intentionally or not a malicious file and a suitable gadget chain is present on the blog...

zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field

A security vulnerability was found in zlib. The flaw triggered a heap-based buffer in inflate in the inflate.c function via a large gzip header extra field. This flaw is only applicable in the call inflateGetHeader...

Django: SQL injection in QuerySet.annotate(),aggregate() and extra()

A flaw was found in the Django package, which leads to a SQL injection. This flaw allows an attacker using a crafted dictionary containing malicious SQL queries to compromise the database completely...

CVE-2022-42778

In windows manager service, there is a missing permission check. This could lead to set up windows manager service with no additional execution privileges needed...

CVE-2022-39102

In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...

CVE-2022-39099

In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...

CVE-2022-39100

In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...

CVE-2022-39097

In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...

CVE-2022-39094

In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...

CVE-2022-39092

In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...

CVE-2022-39093

In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...

CVE-2022-39091

In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed...

PT-2022-24724 · Unknown · Power Management Service

Name of the Vulnerable Software and Affected Versions: Power management service affected versions not specified Description: The issue is related to a missing permission check in the power management service. This could allow setting up the power management service without needing additional...

UNISOC chipset 安全漏洞

The UNISOC chipset is an integrated circuit chipset from China's Unisoc Corporation. A security vulnerability exists in the UNISOC chipset, which stems from a lack of privilege checking in its windows manager service that allows an attacker to set up the windows manager service without additional...

AZL-11465 CVE-2022-4055 affecting package xdg-utils 1.1.3-7

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attac...

CVE-2022-4021

The Permalink Manager Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.2.20.1. This is due to missing or incorrect nonce validation on the extraactions function. This makes it possible for unauthenticated attackers to change plugin settings...

WordPress plugin Permalink Manager Lite 跨站请求伪造漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in WordPress Permalink Manager Lite 2.2.20.1 and prior versions, which stems from missing or...