3671 matches found
Samsung Account 授权问题漏洞
Samsung Account is a mobile account from Samsung, a South Korean company. Samsung Account versions prior to 13.1.0.1 contain an access control error vulnerability that stems from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker...
PT-2022-16994 · Unknown · Setupwizard
Name of the Vulnerable Software and Affected Versions: Setup wizard versions prior to SMR Mar-2022 Release 1 Description: The issue is related to an Improper Protection of Alternate Path vulnerability in the Setup wizard process. This vulnerability allows a physical attacker to install packages...
Nextcloud Talk 输入验证错误漏洞
Nextcloud Talk, a self-hosted local audio/video and chat communication service from Nextcloud Germany, is vulnerable to a user redirection vulnerability in versions prior to 12.1.2. The vulnerability stems from the system's failure to reasonably handle target jumps, which could be exploited to...
CVE-2021-4199
Incorrect Permission Assignment for Critical Resource vulnerability in the crash handling component BDReinit.exe as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint Security Tools for Windows allows a remote attacker to escalate local privileges to SYSTEM. This issu...
WordPress plugin 跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the Custom...
PT-2022-16771 · Zz · Keymouse
Name of the Vulnerable Software and Affected Versions: ZZ Inc. KeyMouse versions 3.08 and prior Description: The issue concerns a remote code execution vulnerability that can be exploited during an unauthenticated update. To trigger the vulnerability, an update of an affected KeyMouse installatio...
CVE-2021-32008
This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Improper Limitation of a Pathname to restricted directory, allows logged in GateManager admin to delete system Files or Directories...
CVE-2022-23233
StorageGRID formerly StorageGRID Webscale versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service DoS of the Local Distribution Router LDR service...
CVE-2021-26948
Null pointer dereference in the htmldoc v1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service via a crafted html file...
npm-lockfile 操作系统命令注入漏洞
npm-lockfile is an open source tool. It can securely generate npm lockfiles and output them to a filename of your choice. A security vulnerability exists in versions prior to npm-lockfile v2.0.5, which can be exploited by attackers to perform OS command injection...
PT-2022-2570
Name of the Vulnerable Software and Affected Versions image processing versions prior to 1.12.2 ruby-image-processing versions prior to 1.10.3-1+deb11u1 Description The image processing library, a wrapper for libvips and ImageMagick/GraphicsMagick, contains a flaw where unsanitized user input...
PT-2022-3565 · Jetbrains · Jetbrains Hub
Name of the Vulnerable Software and Affected Versions: JetBrains Hub versions prior to 2022.1.14434 Description: The issue is related to insufficient authentication data verification in JetBrains Hub, allowing a remote attacker to exploit the vulnerability and gain access to confidential data,...
RosarioSis SQL注入漏洞
RosarioSis is a free and open source student information system. It is used to manage students, create reports and make the right decisions. An SQL injection vulnerability exists in RosarioSIS versions prior to 7.6.1, which originates from the votes parameter in...
CVE-2021-4070
Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0...
DEBIAN-CVE-2021-44141
All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succee...
CVE-2022-23053 Openmct XSS via the “Condition Widget”
Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Condition Widget” element, that allows the injection of malicious JavaScript into the ‘URL’ field. This issue affects: nasa openmct 1.7.7 version and prior versions; 1.3.0 version and later versions...
PT-2022-13299 · Uri.Js · Uri.Js
Name of the Vulnerable Software and Affected Versions: urijs versions prior to 1.19.8 Description: The issue allows an attacker to bypass authorization through a user-controlled key. Specifically, it is possible to use case-insensitive protocol schemes, such as HTTP, htTP, HTtp, etc., to bypass...
AZL-33639 CVE-2022-21698 affecting package rook for versions less than 1.6.2-18
clientgolang is the instrumentation library for Go applications in Prometheus, and the promhttp package in clientgolang provides tooling around HTTP servers and clients. In clientgolang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and...
CVE-2021-4201
Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially admin-level sessions. This issue affects: ForgeRock Access Management 7.1 versions prior to 7.1.1; 6.5 versions prior...