PYSEC-2022-42979

Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data Data Amplification...

PT-2022-35804 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.298 Description: The issue is related to data-races around kcm-rx wait. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to v4.14.298,...

IBM MQ Internet Pass-Thru 日志日志信息泄露漏洞

IBM MQ Internet Pass-Thru is an International Business Machines IBM product for supporting the implementation of messaging between remote sites on the Internet. The product is an extended functionality component of IBM MQ that serves as a protocol channel or proxy for establishing protocols durin...

CVE-2022-44590

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in James Lao's Simple Video Embedder plugin = 2.2 on WordPress...

SAP BusinessObjects BI Platform 代码问题漏洞

SAP BusinessObjects BI Platform is a centralized suite for data reporting, visualization, and sharing from SAP, Germany. A deserialization vulnerability exists in SAP BusinessObjects BI Platform versions 4.2, 4.3, which arises from unsafe deserialization of serialized data received by the...

PT-2022-8327 · Unknown · S::Can Moni::Tools

Name of the Vulnerable Software and Affected Versions: s::can moni::tools versions prior to 4.2 Description: The issue allows an unauthenticated attacker to obtain any file from the device through path traversal in the camera-file module. Recommendations: For versions prior to 4.2, update to...

CVE-2022-43564

In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user who can create search macros and schedule search reports can cause a denial of service through the use of specially crafted search macros...

MKCMS SQL注入漏洞

MKCMS is a content management system. A SQL injection vulnerability exists in MKCMS version V6.2, which stems from the verify parameter of its /ucenter/active.php component that allows an attacker to achieve SQL injection...

CVE-2022-39406

Vulnerability in the PeopleSoft Enterprise Common Components product of Oracle PeopleSoft component: Approval Framework. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

PT-2022-24899 · Unknown · @Keystone-6/Core

Name of the Vulnerable Software and Affected Versions: @keystone-6/core versions 2.2.0 through 2.3.0 Description: The issue affects users of the multiselect field in @keystone-6/core who have configured field-level access control. The field-level access control is not being used, making the data...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A security vulnerability exists in GitLab CE/EE versions 12.8 through 15.2.5,...

CVE-2022-33920

Dell GeoDrive, versions prior to 2.2, contains an Unquoted File Path vulnerability. A low privilege attacker could potentially exploit this vulnerability, leading to the execution of arbitrary code in the SYSTEM security context...

CVE-2022-33921

Dell GeoDrive, versions prior to 2.2, contains Multiple DLL Hijacking Vulnerabilities. A low privilege attacker could potentially exploit this vulnerability, leading to the execution of arbitrary code in the SYSTEM security context...

PT-2022-21910 · Dell · Dell Geodrive

Name of the Vulnerable Software and Affected Versions: Dell GeoDrive versions prior to 2.2 Description: The issue allows a low privilege attacker to potentially exploit an Unquoted File Path vulnerability, leading to the execution of arbitrary code in the SYSTEM security context. Recommendations:...

CVE-2022-42306

An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access can send a crafted packet to pbxexchange during registration and cause a NULL pointer exception, effectively crashing the pbxexchange process...

CVE-2022-3333

A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Affected is an unknown function of the file /v1/tasks/create/ of the component REST Call Handler. The manipulation of the argument onanimationstart leads to cross site scripting. It is possible ...

CVE-2022-38061 WordPress Export Post Info plugin <= 1.2.0 - Authenticated CSV Injection vulnerability

Authenticated author+ CSV Injection vulnerability in Export Post Info plugin = 1.2.0 at WordPress...

CVE-2022-38703

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in Max Foundry Button Plugin MaxButtons plugin = 9.2 at WordPress...

GHSA-JQ8C-J47C-VVWM Apache SOAP's RPCRouterServlet allows reading of arbitrary files over HTTP

An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versions are also affected. NOTE: This...

CVE-2022-2266

University Library Automation System developed by Yordam Bilgi Teknolojileri before version 19.2 has an unauthenticated Reflected XSS vulnerability. This has been fixed in the version 19.2...