phpRedisAdmin 跨站请求伪造漏洞

phpRedisAdmin is an individual developer's web administration page for managing Redis. A security vulnerability exists in phpRedisAdmin versions prior to 1.17.3 that originates from an unknown section and manipulates to cause cross-site request forgery. No details of the vulnerability are availab...

CVE-2022-4617 Cross-site Scripting (XSS) - Reflected in microweber/microweber

Cross-site Scripting XSS - Reflected in GitHub repository microweber/microweber prior to 1.3.2...

PT-2022-27870 · Docconv · Docconv

Name of the Vulnerable Software and Affected Versions: docconv versions prior to 1.2.1 Description: A critical issue affects the function ConvertPDFImages of the file pdf ocr.go. The manipulation of the argument path leads to os command injection. The attack can be initiated remotely...

PT-2022-17110 · P4 · P4

Name of the Vulnerable Software and Affected Versions: p4 versions prior to 0.0.7 Description: The issue is related to Command Injection via the run function due to improper input sanitization. Recommendations: For versions prior to 0.0.7, update to version 0.0.7 or later to resolve the issue. As...

OpenEMR 跨站脚本漏洞

OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A cross-site scripting vulnerability exists in versions prior to OpenEMR 7.0.0.2. ...

PT-2022-27734 · Unknown · Usememos/Memos

Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.0 Description: The issue is related to stored Cross-site Scripting XSS in the usememos/memos GitHub repository. This allows for malicious scripts to be stored and executed on the platform. A patch is...

CVE-2022-4606

PHP Remote File Inclusion in GitHub repository flatpressblog/flatpress prior to 1.3...

FlatPress 跨站脚本漏洞

FlatPress is a Php-based blog builder without database support from the FlatPress community. A cross-site scripting vulnerability exists in flatpressblog/flatpress versions prior to 1.3, which stems from the presence of cross-site scripting XSS...

BigBlueButton 信息泄露漏洞

BigBlueButton is an open source web conferencing system from the BigBlueButton community. An information disclosure vulnerability exists in versions of BigBlueButton prior to 2.4.0, which can be exploited by an attacker to start a subscription to the results of an anonymous poll before it is...

CVE-2022-4505

Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.2...

CVE-2022-4503

Cross-site Scripting XSS - Generic in GitHub repository openemr/openemr prior to 7.0.0.2...

PT-2022-27704 · Alist · Alist

Name of the Vulnerable Software and Affected Versions: Alist versions prior to 3.6.0 Description: The issue allows a user with only file upload permission to bypass the base path restriction by using '../' to upload files to an arbitrary path, which is a form of Directory Traversal or Path...

WSO2 carbon-registry 跨站脚本漏洞

The WSO2 carbon-registry is a platform from WSO2 USA, Inc. that allows organizations to track, manage and trade greenhouse gas emissions GHG emissions. A security vulnerability exists in WSO2 carbon-registry versions prior to 4.8.11. An attacker exploited the vulnerability to perform a cross-site...

OpenEMR 跨站脚本漏洞

OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A cross-site scripting vulnerability exists in versions prior to OpenEMR 7.0.0.2. ...

CVE-2022-4506 Unrestricted Upload of File with Dangerous Type in openemr/openemr

Unrestricted Upload of File with Dangerous Type in GitHub repository openemr/openemr prior to 7.0.0.2...

Apple iOS 输入验证错误漏洞

Apple iOS is an operating system developed by Apple Inc. for mobile devices. A security vulnerability exists in iOS prior to 15.6, iPadOS prior to 15.6, and macOS Monterey prior to 12.5, which stems from an integer overflow issue in input validation, and may allow an application to execute...

DEBIAN-CVE-2022-4436

Use after free in Blink Media in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2022-4436

Use after free in Blink Media in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2022-4446

PHP Remote File Inclusion in GitHub repository tsolucio/corebos prior to 8.0...

CVE-2022-46160 Tuleap dashboards vulnerable to Incorrect Authorization

Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14.2.99.104, project level authorizations are not properly verified when accessing the project "homepage"/dashboards. Users not authorized to access a project may still be able to...