CVE-2021-25007

The MOLIE WordPress plugin through 0.5 does not validate and escape a post parameter before using in a SQL statement, leading to an SQL Injection...

Ametys Cms 信息泄露漏洞

Ametys Cms is used to run large enterprise websites, blogs, Intranet and Extranet on the same server.Ametys Community Cms a free open source content management system written in Java. An information disclosure vulnerability exists in the Ametys CMS auto-completion plugins, which originated in the...

PT-2022-17702 · Unknown · Ametys Cms

Name of the Vulnerable Software and Affected Versions: Ametys CMS versions prior to 4.5.0 Description: The auto-completion plugin in Ametys CMS allows a remote unauthenticated attacker to read documents, which contain all characters typed by all users, including the content of private pages. Thes...

CVE-2021-29216

A remote cross-site scripting vulnerability was discovered in HPE OneView Global Dashboard versions: Prior to 2.5. HPE has provided a software update to resolve this vulnerability in HPE OneView Global Dashboard...

HelpSystems Cobalt Strike 授权问题漏洞

HelpSystems HelpSystems Cobalt Strike is a penetration testing software from HelpSystems USA. A security vulnerability exists in HelpSystems Cobalt Strike that stems from the CobaltStrike =4.5 HTTPS listener not determining if a request URL begins with "/", which allows an attacker to obtain...

PT-2022-1766

Name of the Vulnerable Software and Affected Versions Expat aka libexpat versions prior to 2.4.5 Description The issue is related to insufficient input validation in the xmlparse.c component of the Expat library, allowing attackers to insert namespace-separator characters into namespace URIs. Thi...

AntD Admin 访问控制错误漏洞

AntD Admin is an excellent front-end solution for enterprise applications built on Ant Design and UmiJs by Zuiidea individual developers. A security vulnerability exists in AntD Admin, which originates from Antd-admin 5.5.0 is affected by a False Access Control vulnerability. An attacker can...

StarWind iSCSI SAN 资源管理错误漏洞

StarWind iSCSI SAN is a kind of iSCSI storage from StarWind, USA. It is suitable for small and medium-sized businesses that need to store and transfer large amounts of data over a network. A resource management error vulnerability exists in versions prior to StarWind iSCSI SAN 3.5 build 2007-08-0...

PYSEC-2022-148

Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a use after free behavior when decoding PNG images. After png::CommonFreeDecode gets called, the values of decode.width and decode.height are in an unspecified state. The fix will be included in TensorFlow 2.8.0. ...

PT-2022-16112 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1 and earlier TensorFlow versions 2.6.3 and earlier TensorFlow versions 2.5.3 and earlier Description: The issue occurs when building an XLA compilation cache with default settings,...

ALPINE-CVE-2021-46668

MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitations for temporary data structures...

CVE-2021-46504

There is an Assertion 'vp != resPtr' failed at jsiEval.c in Jsish v3.5.0...

CVE-2021-46491

Jsish v3.5.0 was discovered to contain a SEGV vulnerability via JsiCommandPkgOpts at src/jsiCmds.c. This vulnerability can lead to a Denial of Service DoS...

Jsish 安全漏洞

Jsish is a small JavaScript parser with a built-in database written in C. A security vulnerability exists in Jsish v3.5.0, which could lead to a denial of service DoS...

Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior 7.5.24 and prior 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L).

...

CVE-2022-23856

An issue was discovered in Saviynt Enterprise Identity Cloud EIC 5.5 SP2.x. An attacker can enumerate users by changing the id parameter, such as for the ECM/maintenance/forgotpasswordstep1 URI...

PT-2022-16294 · Saviynt · Saviynt Enterprise Identity Cloud

Name of the Vulnerable Software and Affected Versions: Saviynt Enterprise Identity Cloud EIC version 5.5 SP2.x Description: An issue was discovered that allows an attacker to enumerate users by changing the id parameter in the "ECM/maintenance/forgotpasswordstep1" API endpoint. Recommendations: F...

CVE-2021-46333

Moddable SDK v11.5.0 was discovered to contain an invalid memory access vulnerability via the component asanmemmove...

CVE-2021-46328

Moddable SDK v11.5.0 was discovered to contain a heap-buffer-overflow via the component libcstartmain...

CVE-2021-46028

In mblog = 3.5.0 there is a CSRF vulnerability in the background article management. The attacker constructs a CSRF load. Once the administrator clicks a malicious link, the article will be deleted...