CVE-2022-2808

Authorization Bypass Through User-Controlled Key vulnerability in Algan Software Prens Student Information System allows Object Relational Mapping Injection.This issue affects Prens Student Information System: before 2.1.11...

WordPress plugin Chained Quiz 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

Enhancesoft osTicket 跨站脚本漏洞

Enhancesoft osTicket is an open source ticketing system from Enhancesoft, Inc. in the United States. A security vulnerability exists in Enhancesoft osTicket versions prior to 1.16.4. The vulnerability stems from setting an ordinary user's username as the XSS payload, and then placing the same XSS...

PT-2022-23365 · Rocket · Rocket Trufusion Enterprise

Name of the Vulnerable Software and Affected Versions: Rocket TRUfusion Enterprise versions prior to 7.9.6.1 Description: The issue allows unauthenticated attackers to execute arbitrary code via a crafted JSP file. This is due to an arbitrary file upload vulnerability. Recommendations: For versio...

UBUNTU-CVE-2022-4195

Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass Safe Browsing warnings via a malicious file. Chromium security severity: Medium...

M-Files Server 安全漏洞

M-Files Server is a server for the M-Files system from M-Files, Inc. A security vulnerability exists in M-Files Server versions prior to 22.6.11534.1, prior to 22.6.11505.0, which stems from an error in a parser function. An attacker could exploit the vulnerability to access certain information i...

PT-2022-15754 · Snyk · Snyk-Python-Plugin +7

Name of the Vulnerable Software and Affected Versions: snyk versions prior to 1.1064.0 snyk-mvn-plugin versions prior to 2.31.3 snyk-gradle-plugin versions prior to 3.24.5 @snyk/snyk-cocoapods-plugin versions prior to 2.5.3 snyk-sbt-plugin versions prior to 2.16.2 snyk-python-plugin versions prio...

CVE-2022-46148 Discourse allows self-XSS through malicious composer message

Discourse is an open-source messaging platform. In versions 2.8.10 and prior on the stable branch and versions 2.9.0.beta11 and prior on the beta and tests-passed branches, users composing malicious messages and navigating to drafts page could self-XSS. This vulnerability can lead to a full XSS o...

CVE-2022-3751 SQL Injection in owncast/owncast

SQL Injection in GitHub repository owncast/owncast prior to 0.0.13...

Owncast SQL注入漏洞

Git is a free, open source distributed version control system. A SQL injection vulnerability exists in versions prior to Owncast 0.0.13. An attacker can exploit this vulnerability to obtain sensitive database information...

CVE-2022-3769

The OWM Weather WordPress plugin before 5.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as contributor...

PT-2022-27763 · Unknown · Drag/Drop Xblock

Name of the Vulnerable Software and Affected Versions: Drag and Drop XBlock v2 versions prior to 3.0.0 Description: The issue affects the Drag and Drop XBlock v2, which implements a drag-and-drop style problem. It is vulnerable to cross-site scripting in multiple XBlock Fields. Any platform that...

PT-2022-23685

Name of the Vulnerable Software and Affected Versions HTML Forms WordPress plugin versions prior to 1.3.25 Description The issue is related to a SQL injection that occurs because a parameter is not properly escaped before being used in a SQL statement. This can be exploited by high privilege user...

PT-2022-27687 · Unknown · Fusionauth

Name of the Vulnerable Software and Affected Versions: FusionAuth versions prior to 1.41.3 Description: The issue allows an attacker to view or retrieve files outside of the application root using an HTTP request. Specifically, an attacker may be able to access any file readable by the user runni...

PT-2022-24371 · Thematosoup · The Fancier Author Box

Name of the Vulnerable Software and Affected Versions: The Fancier Author Box by ThematoSoup WordPress plugin versions prior to 1.5 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html...

PT-2022-27691 · Unknown · Opendaylight

Name of the Vulnerable Software and Affected Versions: OpenDaylight versions prior to 0.16.5 Description: A SQL injection issue was discovered in the AAA component of OpenDaylight. The deleteRole function in RoleStore.java is affected when using the API interface /auth/v1/roles/. Recommendations:...

PT-2022-24906 · Nextcloud +2 · Nextcloud Desktop Client +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop client versions prior to 3.6.1 Description: An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application. There are no known workarounds for this issue. Recommendations: For versions prior t...

PT-2022-24904 · Nextcloud +2 · Nextcloud Desktop Client +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop client versions prior to 3.6.1 Description: An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. There are no known workarounds for this issue. Recommendations:...

ZOHO ManageEngine ServiceDesk Plus 命令注入漏洞

ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL-based architecture of IT service management software. The software integrates Incident Management, Problem Management, Asset Management, IT Project Management, Procurement and Contract Management, and...

NdkAdvancedCustomizationFields 代码问题漏洞

NdkAdvancedCustomizationFields is an advanced customization field from Ndk. A server-side request forgery vulnerability exists in NdkAdvancedCustomizationFields 3.5.0 and prior versions, which stems from rotateimg.php failing to properly validate user input. An attacker could use this vulnerabili...