ROS-20220407-03

A vulnerability in the Python client library is related to insufficient validation of user input data in the FTP File Transfer Protocol library when used in PASV passive mode in the FTP File Transfer Protocol library when it is used in PASV passive mode. Exploitation the vulnerability could allow...

Chromium: CVE-2022-1130 Insufficient validation of untrusted input in WebOTP

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

KLA12495 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, gain privileges, spoof user interface. Below is a complete list of vulnerabilities: 1. Use after free vulnerability in Portals can be...

Insecure Authentication

PowerDNS has insecure authentication. The vulnerability exists due to a lack of insufficient validation of an IXFR end condition which causes incomplete zone transfers to be handled as successful transfers...

Input validation

In PowerDNS Authoritative Server before 4.4.3, 4.5.x before 4.5.4, and 4.6.x before 4.6.1 and PowerDNS Recursor before 4.4.8, 4.5.x before 4.5.8, and 4.6.x before 4.6.1, insufficient validation of an IXFR end condition causes incomplete zone transfers to be handled as successful transfers...

CVE-2022-0888 Ninja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File Upload

The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the /includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to upload malicious file...

EUVD-2022-15924

The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the /includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to upload malicious file...

Luocms arbitrary file writing vulnerability

Luocms v2.0 is an article management system. Luocms v2.0 is vulnerable to an arbitrary file-writing vulnerability that results from insufficient validation of filecontent submissions and filenamede filenames, which can be exploited to write arbitrary shell files via /admin/templates/templatemanag...

Cisco NX-OS Software Cisco Fabric Services Over IP DoS (cisco-sa-cfsoip-dos-tpykyDr)

According to its self-reported version, Cisco NX-OS Software is affected by a vulnerability in the Cisco Fabric Services over IP component which could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. This vulnerability is due to insufficient...

Celartem Extensis Portfolio 代码问题漏洞

Celartem Extensis Portfolio is a digital asset management solution from Celartem Japan. A code issue vulnerability exists in Celartem Extensis Portfolio versions 3.0.0 through 3.6.3, which stems from insufficient validation of files during file uploads in the main portal. A remote user can upload...

YzmCMS Cross-site Request Forgery Vulnerability (CNVD-2022-12752)

YzmCMS is an open source CMS Content Management System.A cross-site request spoofing vulnerability exists in YzmCMS, which stems from insufficient validation in admin.add that the request is coming from a trusted user. An attacker could use this vulnerability to spoof malicious requests to trick...

Rocky Linux 8 : kernel-rt (RLSA-2021:4646)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:4646 advisory. - A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the timerqueueadd function in lib/timerqueue.c...

Mageia: Security Advisory (MGASA-2021-0555)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2018-0395)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Buffer Overflow Vulnerability in Multiple Huawei Products (CNVD-2022-17397)

The Huawei CloudEngine 12800 is a 12800 series data center switch, and the Huawei Cloudengine 5800 is a 5800 series data center switch. Buffer overflow vulnerability exists in several Huawei products. The vulnerability stems from insufficient validation of certain parameters in messages, which ca...

CVE-2022-20636 Cisco Security Manager Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the...

Improper Certificate Validation

nodejs is vulnerable to Improper Certificate Validation. The vulnerability exists due to insufficient validation of URI subject alternative names which allows an attacker to bypass the certificate subject verification...

Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerabilities (USN-5218-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5218-1 advisory. Nadav Amit discovered that the hugetlb implementation in the Linux kernel did not perform TLB flushes under certain conditions. A local attacker could us...

Sql injection

Changing MOTP Mobile One Time Password system’s specific function parameter has insufficient validation for user input. A attacker in local area network can perform SQL injection attack to read, modify or delete backend database without authentication...

CVE-2021-44161 Changing Information Technology Inc. MOTP(Mobile One Time Password) - SQL Injection

Changing MOTP Mobile One Time Password system’s specific function parameter has insufficient validation for user input. A attacker in local area network can perform SQL injection attack to read, modify or delete backend database without authentication...