PT-2022-25833 · Pypi · Democritus-File-System +1

Name of the Vulnerable Software and Affected Versions: d8s-json version 0.1.0 Description: The d8s-json package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. Recommendations: For...

CVE-2022-40834

B.C. Institute of Technology CodeIgniter =3.1.13 is vulnerable to SQL Injection via system\database\DBquerybuilder.php ornotlike function. Note: Multiple third parties have disputed this as not a valid vulnerability...

IBM CICS TX 安全漏洞

IBM CICS TX is a comprehensive, single transaction runtime package from International Business Machines IBM. A security vulnerability exists in IBM CICS TX Standard version 11.1 that results in a denial of service from improper load handling...

Huawei HarmonyOS 缓冲区错误漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a microkernel-based distributed operating system. Huawei HarmonyOS version 2.0 and 2.1 of the HwAirlink module are vulnerable to an out-of-bounds read vulnerability that could be exploited by attackers to obtain sensitive...

Zyxel CloudCNM SecuManager 安全漏洞

Zyxel CloudCNM SecuManager is a set of network management software from Taiwan, China-based Zyxel. The software supports centralized control, device management and intelligent monitoring. A security vulnerability exists in Zyxel CloudCNM SecuManager version 3.1.0 and 3.1.1, which originates from ...

IBM WebSphere MQ 安全漏洞

IBM WebSphere MQ is a system from International Business Machines IBM, Inc. A denial-of-service vulnerability exists in IBM WebSphere MQ version 7.1. A remote attacker could use this vulnerability to bypass security configuration settings and cause a denial of service...

PT-2022-24415 · WordPress · Notice Board

Name of the Vulnerable Software and Affected Versions: NOTICE BOARD plugin versions = 1.1 at WordPress. Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with contributor or higher privileges can inject malicious scrip...

CVE-2022-2265

The Identity and Directory Management System developed by Çekino Bilgi Teknolojileri before version 2.1.25 has an unauthenticated Path traversal vulnerability. This has been fixed in the version 2.1.25...

CVE-2022-38931

A Server-Side Request Forgery SSRF in fetchnetfileupload function of baijiacmsV4 v4.1.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the url parameter...

CVE-2022-38882

The d8s-json for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

PYSEC-2022-43076

The d8s-grammars for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

PT-2022-37368 · Pypi · D8S-Dates +1

Name of the Vulnerable Software and Affected Versions: d8s-dates version 0.1.0 Description: A potential code-execution backdoor was inserted by a third party into the d8s-dates package for python, distributed on PyPI. The backdoor is related to the democritus-hypothesis package. Recommendations:...

PT-2022-34012 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.140 Description: The issue is related to the prohibition of usage of non-balanced queue id in the ice: xsk component. The actual impact and attack plausibility have not yet been proven. Recommendations: Fo...

CVE-2022-3222

Uncontrolled Recursion in GitHub repository gpac/gpac prior to 2.1.0-DEV...

CVE-2022-38796

A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header. This can be exploited by abusing password reset emails...

CVE-2022-40325

SysAid Help Desk before 22.1.65 allows XSS via the Asset Dashboard, aka FR 67262...

ftcms 跨站脚本漏洞

ftcms is a content management system from ftcms, Inc. A security vulnerability exists in ftcms version 2.1, which stems from its poster.PHP page that allows an attacker to insert malicious JavaScript code into a web page, resulting in the triggering of malicious code when a user/administrator...

CVE-2022-2083

The Simple Single Sign On WordPress plugin through 4.1.0 leaks its OAuth clientsecret, which could be used by attackers to gain unauthorized access to the site...

WordPress plugin Easy Org Chart 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin Easy Org Chart version 3.1 and prior versions are vulnerable to cross-site scripting. An...

AeroCMS SQL注入漏洞

AeroCMS is a content management system from AeroCMS Inc. in the United States. A security vulnerability exists in AeroCMS version 0.1.1 that stems from vulnerability to SQL injection attacks via the author parameter...