CVE-2020-28884

Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject Groovy script to execute any OS command on the Liferay Portal Sever. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to run groo...

OESA-2022-1506 curl security update

Curl is used in command lines or scripts to transfer data. Security Fixes: When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from...

[SECURITY] Fedora 35 Update: grafana-7.5.11-3.fc35

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB...

PT-2022-3888 · Reolink · Reolink Rlc-410W

Name of the Vulnerable Software and Affected Versions: reolink RLC-410W version 3.0.0.136 20121102 Description: An out-of-bounds write issue exists in the device's TestEmail functionality. A specially-crafted network request can lead to an out-of-bounds write. An attacker can send an HTTP request...

Mageia: Security Advisory (MGASA-2016-0280)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ZEIT Next.js 资源管理错误漏洞

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack and Babel.js. Next.js suffers from a security vulnerability that could allow bad actors to trigger a denial of service attack against anyone using the i18n feature...

Mageia: Security Advisory (MGASA-2016-0423)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Zulip server security feature issue vulnerability

Zulip server is an open source team chat application from the American company Zulip. A security signature issue vulnerability exists in Zulip Server versions prior to 4.9, which results from incorrect input validation. A remote attacker can exploit this vulnerability to send a crafted request an...

TrickBot Crashes Security Researchers’ Browsers in Latest Upgrade

Trojan titan TrickBot has added a striking anti-debugging feature that detects security analysis and crashes researcher browsers before its malicious code can be analyzed. The new anti-debugging feature was discovered by Security Intelligence analysts with IBM, who reported the emergence of a...

Google Chrome Security Feature Issue Vulnerability (CNVD-2022-15135)

Google Chrome is a web browser from Google, Inc. Google Chrome is vulnerable to a security feature that could be exploited by attackers to bypass navigation restrictions via carefully designed HTML pages...

CVE-2022-21701

Istio is an open platform to connect, manage, and secure microservices. In versions 1.12.0 and 1.12.1 Istio is vulnerable to a privilege escalation attack. Users who have CREATE permission for gateways.gateway.networking.k8s.io objects can escalate this privilege to create other resources that th...

CVE-2021-43925

Improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in Log Management functionality in Synology DiskStation Manager DSM before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors...

Google Chrome Security Feature Issue Vulnerability (CNVD-2022-15154)

Google Chrome is a web browser from Google, Inc. Google Chrome is vulnerable to a security feature that could be exploited by attackers to bypass site quarantine via crafted HTML pages...

Lexmark Printer Configuration Wipe Vulnerability (Jan 2022)

The initial admin account setup wizard on Lexmark devices allow unauthenticated access to the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-late...

Google Chrome Security Feature Issue Vulnerability (CNVD-2022-15156)

Google Chrome is a web browser from Google, Inc. Google Chrome is vulnerable to a security feature that could be exploited by attackers to bypass site quarantine via crafted HTML pages...

Backdoor.Win32.Wollf.16 Authentication Bypass

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/204613443e555f73237ea43a2faecaa5.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Wollf.16 Vulnerability: Authentication Bypass Description: The malware listens on TCP...

Design/Logic Flaw

The initial admin account setup wizard on Lexmark devices allow unauthenticated access to the “out of service erase” feature...

Philips Vue PACS 路径遍历漏洞

Philips Vue PACS is an image management solution from Philips, a Dutch company. A security vulnerability exists in Philips Vue PACS that stems from a VideoStream feature that allows authenticated users to access files stored outside of the web root directory...

Telenot CompasX 安全特征问题特征问题漏洞

Telenot CompasX is a parameter setting software from Telenot. Telenot CompasX suffers from a security signature issue vulnerability that arises from the use of weak seeding to generate random numbers, which results in a risk of decryption...

Privilege escalation

Istio is an open platform to connect, manage, and secure microservices. In versions 1.12.0 and 1.12.1 Istio is vulnerable to a privilege escalation attack. Users who have CREATE permission for gateways.gateway.networking.k8s.io objects can escalate this privilege to create other resources that th...