2423 matches found
Pydio 跨站脚本漏洞
Pydio AjaXplorer is a web-based remote file manager from Pydio. The manager supports uploading and downloading files, online file editing, image previewing, and more. A security vulnerability exists in Pydio version 4.2.3, which can be exploited by an attacker to cause a cross-site scripting...
PT-2022-24419 · Coreshield · Coreshield One-Way Gateway
Name of the Vulnerable Software and Affected Versions: CoreShield One-Way Gateway OWG Software versions prior to V2.2 Description: A security issue has been identified where the default installation of the software sets insecure file permissions. This could allow a local attacker to escalate...
mariadb: server crash in Item_args::walk_args
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Itemargs::walkargs...
多款 ZITADEL 产品 安全漏洞
ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the age of containers and serverless, open sourced by ZITADEL in Switzerland. ZITADEL suffers from a security vulnerability that stems from a lack of authorization checks, where Actions is abl...
PT-2022-23473 · Wamp · Wamp
Name of the Vulnerable Software and Affected Versions: Wamp versions 3.2.6 and below Description: The issue is related to incorrect access control in the install directory of Wamp, allowing authenticated attackers to execute arbitrary code by overwriting binaries in the directory. Recommendations...
Heap-based Buffer Overflow
Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the getle32 function in bele.h via a crafted Mach-O file. Remediation Upgrade upx to version 4.2.1 or higher. References - GitHub Commit - GitHub Issue Credit: giantbranch of NSFOCUS Security Team...
CVE-2022-2378
The Easy Student Results WordPress plugin through 2.2.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...
CVE-2022-2713
Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0...
Synology DiskStation Manager 操作系统命令注入漏洞
Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology Inc. of Taiwan, China. This operating system manages information such as data, files, photos, music, and more. An operating system command injection vulnerability exists in Synology...
Trend Micro VPN Proxy Pro 安全漏洞
Trend Micro VPN Proxy Pro is one of the best virtual private network services from Trend Micro. A security vulnerability exists in Trend Micro VPN Proxy Pro version 5.2.1026 and prior versions. A local attacker could exploit the vulnerability to gain elevation of privilege on affected systems...
Out-of-bounds Read
Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the core interpreter of sqclass.cpp, which may lead to Arbitrary Code Execution if a victim executes an attacker-controlled squirrel script. Remediation Upgrade squirrel to version 3.2 or higher. References - GitH...
mariadb: segmentation fault in Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exectimetracker::getloops/Filesorttracker::reportuse/filesort...
Veritas NetBackup 安全漏洞
Veritas NetBackup is a storage service from Veritas, Inc. that is used to provide backup and recovery capabilities for enterprise environments. The software supports ransomware detection and backup protection of environmental data such as metadata and virtual environments. A security vulnerabilit...
CVE-2022-21575
Vulnerability in the Oracle WebCenter Sites Support Tools product of Oracle Fusion Middleware component: User Interface. The supported version that is affected is Prior to 4.4.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...
CVE-2022-21561
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Web Runtime. Supported versions that are affected are 9.2.6.3 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne...
CVE-2022-2443
The FreeMind WP Browser plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.2. This is due to missing nonce protection on the FreemindOptions function found in the /freemind-wp-browser.php file. This makes it possible for unauthenticated attackers t...
CVE-2022-22304
An improper neutralization of input during web page generation vulnerability CWE-79 in FortiAuthenticator OWA Agent for Microsoft version 2.2 and 2.1 may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests...
CVE-2022-30517
Mogu blog 5.2 is vulnerable to Cross Site Scripting XSS...
CVE-2022-33736
A vulnerability has been identified in Opcenter Quality V13.1 All versions V13.1.20220624, Opcenter Quality V13.2 All versions V13.2.20220624. The affected applications do not properly validate login information during authentication. This could lead to denial of service condition for existing...