Zephyr 缓冲区错误漏洞

Zephyr is an extensible real-time operating system RTOS open-sourced by the Zephyr Project. A security vulnerability exists in Zephyr version v2.5.0 and later, which stems from a stack-based buffer overflow in leecredconnreq...

CVE-2022-33095

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist...

CVE-2021-40955

SQL injection exists in LaiKetui v3.5.0 the background administrator list...

CVE-2022-30874

There is a Cross Site Scripting Stored XSS vulnerability in NukeViet CMS before 4.5.02...

PYSEC-2022-208

django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entire AWS S3 bucket and in most cases to access or delete files. If the AWSLOCATION setting was set, traversal was limited to that location only. The issue was...

WordPress plugin Database Backup 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. cross-site request forgery vulnerability exists in versions of WordPress Database Backup plugin prior to 2.5....

PT-2022-13995 · WordPress · Wpqa Builder

Name of the Vulnerable Software and Affected Versions: WPQA Builder WordPress plugin versions prior to 5.5 Description: The issue concerns a lack of authentication in a REST API endpoint, allowing unauthenticated users to discover private questions sent between users on the site. This affects the...

PT-2022-18016 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 15.5 iPadOS versions prior to 15.5 Description: An authorization issue was addressed with improved state management, allowing a person with physical access to an iOS device to potentially access photos from the lock...

Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names

An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service application crash via an @ character before a JavaScript field name...

Atmail 跨站脚本漏洞

Atmail is an email hosting service from Atmail. Atmail version 6.5.0 contains a cross-site scripting vulnerability that originates from an incorrect parameter in index.php/admin/index/ and can be exploited to execute JavaScript code...

CVE-2021-22531

A bug exist in the input parameter of Access Manager that allows supply of invalid character to trigger cross-site scripting vulnerability. This affects NetIQ Access Manager 4.5 and 5.0...

Micro Focus NetIQ Access Manager 跨站脚本漏洞

Micro Focus NetIQ Access Manager NAM is a resource access control solution from Micro Focus UK. The solution provides multiple authentication, data encryption, single sign-on and SSLVPN for local and remote users. A security vulnerability exists in Micro Focus NetIQ Access Manager 4.5 and 5.0,...

CVE-2022-30236

A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could allow unauthorized access when an attacker uses cross-domain attacks. Affected Products: Wiser Smart, EER21000 & EER21001 V4.5 and prior...

CVE-2022-27461

In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link...

OpenJDK: Defective secure validation in Apache Santuario (Libraries, 8278008)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable...

CVE-2022-22345

IBM QRadar 7.3, 7.4, and 7.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 220041...

CVE-2022-28053

Typemill v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the upload function. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

Vulnerability fixed in Mattermost

A vulnerability has been fixed in Mattermost with versions lower than 6.5. Email invitations to a Mattermost channel or server are insufficiently invalidated when selected by an administrator. This allows a person to still participate in Mattermost channels even though access has been revoked aft...

CVE-2022-21456

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Navigation Pages, Portal, Query. Supported versions that are affected are 8.58 and 8.59. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2022-21419

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware component: Visual Analyzer. Supported versions that are affected are 5.5.0.0.0 and 5.9.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...