CVE-2022-27133

zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php...

CVE-2022-27126

zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php...

CVE-2022-27126

zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php...

Arbitrary file deletion

zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php...

Sql injection

zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php...

CVE-2022-27126: Improper Neutralization of Special Elements used in an SQL Command

zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php...

PT-2022-18235

Name of the Vulnerable Software and Affected Versions zbzcms version 1.0 Description A SQL injection issue was found in zbzcms via the art parameter at the "/include/make.php" API endpoint. Recommendations For zbzcms version 1.0, avoid using the art parameter in the "/include/make.php" endpoint...

CVE-2022-27133: Undefined Security Weakness

zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php...

PT-2022-18241

Name of the Vulnerable Software and Affected Versions zbzcms version 1.0 Description The issue is related to an arbitrary file deletion vulnerability. This vulnerability can be exploited via the "/include/up.php" API endpoint. Recommendations For zbzcms version 1.0, as a temporary workaround,...

CVE-2022-27462

Cross Site Scripting XSS vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php...

CVE-2022-27462: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php...

PT-2022-18434

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions through 11.6 Description The issue is related to a Cross Site Scripting XSS vulnerability in the getDeviceID function within objects/function.php. This vulnerability can be exploited via the yptDevice parameter in the...

PT-2022-37961

Уязвимость функции cs35l41 volatile reg модуля include/sound/cs35l41.h ядра операционной системы Linux связана с чтением за границами буфера. Эксплуатация уязвимости может позволить нарушителю получить доступ к защищаемой информации или вызвать отказ в обслуживании...

CVE-2022-1120

Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration...

UBUNTU-CVE-2022-1120

Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration...

CVE-2022-1120

Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration...

CVE-2022-1120: Generation of Error Message Containing Sensitive Information

Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration...

PT-2022-13670 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 14.7.7 GitLab CE/EE versions 14.8 prior to 14.8.5 GitLab CE/EE versions 14.9 prior to 14.9.2 Description: The issue concerns missing filtering in an error message, which exposes sensitive information when an...

Command Injection

asciidoctor-include-ext is vulnerable to Command Injection. The library renders user-supplied input in AsciiDoc markup, which allows an attacker to execute arbitrary system commands on the host operating system when the allow-uri-read is disabled...

DEBIAN-CVE-2022-24803

Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. This attack is possible...