The vulnerability of the SetDdns-domain component in the Reolink RLC-410W camera’s microprogramming system allows a intruder to execute arbitrary commands.

The vulnerability of the SetDdns-domaind component in the Reolink RLC-410W video camera software exists because measures to neutralize the special elements used in the operating system commands have not been taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary comman...

Security Bulletin: Multiple vulnerabilities in Netty libraries affect IBM Operations Analytics Predictive Insights (CVE-2021-43797 CVE-2022-24823)

Summary Netty library vulnerabilities affect IBM Operations Analytics Predictive Insights CVE-2021-43797 CVE-2022-24823. Netty is used by IBM Operations Analytics Predictive Insight in the REST Mediation utility. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2021-43797...

Oracle Linux 9 : varnish (ELSA-2022-8643)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-8643 advisory. 6.6.2-2.1 - Resolves: 2142095 - CVE-2022-45060 varnish: Request Forgery Vulnerability Tenable has extracted the preceding description block directly from the...

Zimbra Collaboration Server 8.8.x < 8.8.15 Patch 35 / 9.0.0 < 9.0.0 Patch 28 Multiple Vulnerabilities

According to its self-reported version number, Zimbra Collaboration Server is affected by a multiple vulnerabilities, as follows: - A vulnerability in the ClamAV package: On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and...

GHSA-RMCX-FG5W-X8J9 FusionAuth vulnerable to directory traversal attack

FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process...

Design/Logic Flaw

FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process...

Security Bulletin: IBM Planning Analytics Workspace is affected by vulnerabilities in Node.js and Spring Data MongoDB

Summary IBM Planning Analytics Workspace is affected by vulnerabilties in Node.js and Spring Data MongoDB CVE-2022-32212, CVE-2022-32213, CVE-2022-32223, CVE-2022-32214, CVE-2022-32222, CVE-2022-32215, CVE-2022-22980 Vulnerability Details CVEID:CVE-2022-32212 DESCRIPTION: Node.js could allow a...

CVE-2022-45921

FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process...

CVE-2022-45921

FusionAuth, prior to version 1.41.3, is vulnerable to a path traversal flaw that lets an HTTP request view or retrieve files outside the application root that are readable by the FusionAuth process user. The issue originates from handling requests outside the intended directory, enabling potentia...

Oracle Linux 8 : varnish:6 (ELSA-2022-8649)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-8649 advisory. - Resolves: 2142092 - CVE-2022-45060 varnish:6/varnish: Request Forgery Vulnerability - Resolves: 2047650 - CVE-2022-23959 varnish:6/varnish: Varnish HTTP/1...

Debian dla-3208 : libvarnishapi-dev - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3208 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3208-1 [email protected]...

GHSA-XQCF-VGQC-PCMG Moodle blind Server-Side Request Forgery (SSRF) vulnerability in LTI provider library

A blind Server-Side Request Forgery SSRF vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a...

Moodle blind Server-Side Request Forgery (SSRF) vulnerability in LTI provider library

A blind Server-Side Request Forgery SSRF vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a...

Server side request forgery (ssrf)

A blind Server-Side Request Forgery SSRF vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a...

CVE-2022-45152

A blind Server-Side Request Forgery SSRF vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a...

CVE-2022-39833

FileCloud Versions 20.2 and later allows remote attackers to potentially cause unauthorized remote code execution and access to reported API endpoints via a crafted HTTP request...

Remote code execution

FileCloud Versions 20.2 and later allows remote attackers to potentially cause unauthorized remote code execution and access to reported API endpoints via a crafted HTTP request...

CVE-2022-38114

This vulnerability occurs when a web server fails to correctly process the Content-Length of POST requests. This can lead to HTTP request smuggling or XSS...

Cross site scripting

This vulnerability occurs when a web server fails to correctly process the Content-Length of POST requests. This can lead to HTTP request smuggling or XSS...

Cross-Site Request Forgery in Moodle

A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote attacker can trick the victim to visit a...