GLPI 信息泄露漏洞

GLPI is an open source IT and asset management software. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridges and ink cartridges. An...

CVE-2022-21829

Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing ‘concretesecure’ instead of ‘concrete’. Concrete now only makes requests over https even a request comes in via http...

Prison Management System SQL注入漏洞

Prison Management System is a prison management system by Carlo Montero's personal developer. v1.0 of Prison Management System is vulnerable to SQL injection, which originates from the application /pms/admin/inmates/managerecord. php in the id parameter lack of SQL data filter escaping, an attack...

CVE-2022-31374

An arbitrary file upload vulnerability /images/background/1.php in of SolarView Compact 6.0 allows attackers to execute arbitrary code via a crafted php file...

CVE-2022-22317

IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 218281...

Vulnerabilities fixed in Adobe Bridge

Adobe has fixed several vulnerabilities in Bridge. A malicious party could exploit the vulnerabilities to execute arbitrary code in the context of the application, or to access gain access to sensitive data in the context of the application. To do this, the malicious party must trick the victim...

FreeBSD 资源管理错误漏洞

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. A resource management error vulnerability exists in versions of FreeBSD prior to 7.0 that stems from improper handling of TSopt for TCP connections...

CVE-2022-32350

The CVE-2022-32350 entry concerns the Hospital’s Patient Records Management System v1.0, which is vulnerable to SQL Injection via the endpoint /hprms/classes/Master.php?f=delete_room_type. The root cause, as described across sources, is lack of input validation for SQL statements on that page, en...

PT-2022-20733 · Itop +1 · Itop +1

Name of the Vulnerable Software and Affected Versions: ITOP version 3.0.1 Description: A cross-site scripting XSS issue was found in ITOP. The vulnerability can be exploited via the "/itop/pages/ajax.render.php" API endpoint. Recommendations: For ITOP version 3.0.1, as a temporary workaround,...

CVE-2022-32193

Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor...

Couchbase Server 安全漏洞

Couchbase Server is a distributed NoSQL non-relational database from Couchbase USA, which primarily supports data query, full-text search, and active global replication. information disclosure vulnerability exists in versions of Couchbase Server prior to 7.0.4, which stems from the fact that samp...

PT-2022-21372 · Couchbase · Couchbase Server

Name of the Vulnerable Software and Affected Versions: Couchbase Server versions prior to 7.0.4 Description: An issue was discovered in Couchbase Server where XDCR lacks role checking when changing internal settings. Recommendations: For versions prior to 7.0.4, update to version 7.0.4 or later t...

LibreHealth EHR 跨站脚本漏洞

LibreHealth EHR is a clinically-focused electronic health record EHR system designed to be both easy to use out of the box and customizable for use in a variety of healthcare settings.LibreHealth EHR 2.0.0 is vulnerable to a cross-site scripting vulnerability for which no detailed vulnerability...

CVE-2022-32011

Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/applicants/index.php?view=view&id=...

EGavilan Media Contact-Form-With-Messages-Entry-Management SQL注入漏洞

EGavilan Media Contact-Form-With-Messages-Entry-Management is a simple contact form system from EGavilan Media. EGavilan Media Contact-Form-With-Messages-Entry -Management version 1.0 contains a SQL injection vulnerability that stems from vulnerability to SQL injection attacks via Addmessage.php....

Online Car Wash Booking System SQL注入漏洞

Online Car Wash Booking System is an online car wash booking system by Carlo Montero, a personal developer. Online Car Wash Booking System v1.0 is vulnerable to SQL injection, which originates from /ocwbs/admin/vehicles/ managevehicle.php?id=The page lacks validation for external input SQL...

Ascensio System ONLYOFFICE Document Server 缓冲区错误漏洞

Ascensio System ONLYOFFICE Document Server is an online office collaboration suite from Ascensio System, Latvia. The product supports viewing and editing of text, spreadsheets and presentations, among other things. A security vulnerability exists in Onlyoffice Document Server version v6.0.0 and...

mysql: InnoDB unspecified vulnerability (CPU Oct 2021)

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.35 and prior and 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2022-31648

Talend Administration Center is vulnerable to a reflected Cross-Site Scripting XSS issue in the SSO login endpoint. The issue is fixed for versions 8.0.x in TPS-5233, for versions 7.3.x in TPS-5324, and for versions 7.2.x in TPS-5235. Earlier versions of Talend Administration Center may also be...

HashiCorp go-getter 输入验证错误漏洞

HashiCorp go-getter is a library for HashiCorp's Go golang for downloading files or directories from various sources using URLs as the primary form of input. An input validation error vulnerability exists in HashiCorp go-getter version 2.0.2 and prior versions, which stems from the inability to...