GHSA-V4H8-794J-G8MM Arbitrary File Override in Docker Engine

Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules LSM and dockert policies via an image that allows volumes to override files in /proc...

UsersWP < 1.2.3.1 - Subscriber+ User Avatar Override

The plugin is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar. - Right click the thumbnail of another user and copy the image URL. It will be something like:...

CVE-2022-22811

A CWE-352: Cross-Site Request Forgery CSRF vulnerability exists that could induce users to perform unintended actions, leading to the override of the system�s configurations when an attacker persuades a user to visit a rogue website. Affected Product: spaceLYnk V2.6.2 and prior, Wiser for KNX...

CVE-2022-22811

A CWE-352: Cross-Site Request Forgery CSRF vulnerability exists that could induce users to perform unintended actions, leading to the override of the system�s configurations when an attacker persuades a user to visit a rogue website. Affected Product: spaceLYnk V2.6.2 and prior, Wiser for KNX...

Cross site request forgery (csrf)

A CWE-352: Cross-Site Request Forgery CSRF vulnerability exists that could induce users to perform unintended actions, leading to the override of the system?s configurations when an attacker persuades a user to visit a rogue website. Affected Product: spaceLYnk V2.6.2 and prior, Wiser for KNX...

Incorrect Default Permissions in Apache DolphinScheduler

Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface...

spaceLYnk 跨站请求伪造漏洞

Schneider Electric spaceLYnk is a programmable logic controller from Schneider Electric, France. spaceLYnk suffers from a cross-site request forgery vulnerability that stems from the presence of a CWE-352:Cross-Site Request Forgery CSRF vulnerability, which could entice a user to perform an...

SourceCodester Hospital Patient Records Management System horizontal override vulnerability

SourceCodester Hospital Patient Records Management System is a web-based application that provides an automated platform for hospitals to store and manage their patient records. sourceCodester Hospital Patient Records Management System version 1.0 contains a horizontal override vulnerability, whi...

CVE-2022-0270

Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups...

BoreD Agent 安全漏洞

BoreD Agent is an open source agent for the BoreD tunneling daemon from the US-based Lens team. A security vulnerability exists in BoreD Agent versions prior to v0.6.1, which stems from an inability to clear incoming kubernetes emulation headers, which can be exploited by an attacker to override...

CVE-2022-0270

Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups...

Lexmark 路径遍历漏洞

Lexmark is a family of printers in the U.S. A path traversal vulnerability exists in Lexmark devices, which stems from the product's failure to properly filter special elements in resource or file paths. An attacker could access the PJL directory through this vulnerability and could override...

Oracle E-Business Suite (Jan 2022 CPU)

The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2022 CPU advisory. - Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite component: Intelligence, RFx Creation. Supported versions that ar...

Design/Logic Flaw

Vulnerability in the Oracle Project Costing product of Oracle E-Business Suite component: Expenses, Currency Override. Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project...

CVE-2022-21273

Vulnerability in the Oracle Project Costing product of Oracle E-Business Suite component: Expenses, Currency Override. Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project...

CVE-2022-21273

Vulnerability in the Oracle Project Costing product of Oracle E-Business Suite component: Expenses, Currency Override. Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project...

CVE-2022-21273

CVE-2022-21273 affects Oracle E-Business Suite, Project Costing (component: Expenses, Currency Override). Affected versions: 12.2.3–12.2.11. Described as easily exploitable: a low-privilege attacker on the network with HTTP access can compromise Project Costing, leading to unauthorized creation, ...

bpftool, kernel, perf, python security update

CentOS Errata and Security Advisory CESA-2022:0063 An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

DEBIAN-CVE-2022-23132

During Zabbix installation from RPM, DACOVERRIDE SELinux capability is in use to access PID files in /var/run/zabbix folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the file system level...

UBUNTU-CVE-2022-23132

During Zabbix installation from RPM, DACOVERRIDE SELinux capability is in use to access PID files in /var/run/zabbix folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the file system level...