mysql: Server: PAM Auth Plugin unspecified vulnerability (CPU Apr 2022)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: PAM Auth Plugin. Supported versions that are affected are 8.0.28 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server...

mysql: Server: Security: Encryption unspecified vulnerability (CPU Jul 2022)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Encryption. Supported versions that are affected are 8.0.29 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2022-3005 Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm

Cross-site Scripting XSS - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0...

CVE-2022-3242 HTML code Injection in template search keyword in microweber/microweber

Code Injection in GitHub repository microweber/microweber prior to 1.3.2...

CVE-2022-2924

Cross-site Scripting XSS - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3...

CVE-2022-2924 Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm

Cross-site Scripting XSS - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3...

PT-2022-4840 · Dataprobe · Dataprobe Iboot Pdu

Name of the Vulnerable Software and Affected Versions: Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 Description: The issue is related to the device's existing firmware, which allows unauthenticated users to access an old PHP page vulnerable to directory traversal. This may enable a user...

Kayrasoft 2 SQL注入漏洞

Kayrasoft is a multi-platform, full-stack software development platform from the Turkish company Kayrasoft. A security vulnerability exists in previous versions of Kayrasoft 2, which stems from an unauthenticated attacker being able to implement SQL injection...

SFTPGo 跨站脚本漏洞

SFTPGo is a full-featured and highly configurable SFTP server by Nicola Murino, a personal developer in Italy. A cross-site scripting vulnerability exists in SFTPGo versions prior to 2.3.5, which can be exploited by an attacker to inject malicious code...

PT-2022-7566 · Vim +5 · Vim +5

Name of the Vulnerable Software and Affected Versions: vim/vim versions prior to 9.0.0530 Description: The issue is related to a Use After Free vulnerability in the mark.c component of the Vim text editor, which allows an attacker to access confidential data, compromise its integrity, and cause a...

PT-2022-5161 · Oracle +5 · Mysql Server +4

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.29 and prior Description: The issue is related to insufficient input validation in the Server: Optimizer component of MySQL Server, allowing a high-privileged attacker with network access via multiple protocols to...

Information disclosure

Versions of IBM Spectrum Protect Plus prior to 10.1.12 excluding 10.1.12 include the private key information for a certificate inside the generated .crt file when uploading a TLS certificate to IBM Spectrum Protect Plus. If this generated .crt file is shared, an attacker can obtain the private ke...

PT-2022-4871 · Openwrt · Openwrt

Name of the Vulnerable Software and Affected Versions: Openwrt versions prior to 21.02.3 Openwrt version 22.03.0-rc6 Description: The issue is related to a buffer overflow vulnerability in the header value function, which allows attackers to access sensitive information via a crafted HTTP request...

PT-2022-25392 · Tinyproxy +2 · Tinyproxy +2

Name of the Vulnerable Software and Affected Versions: Tinyproxy versions prior to commit 84f203f Description: The issue is related to a potential leak of left-over heap data when custom error page templates containing special non-standard variables are used. This occurs because Tinyproxy commit...

PT-2022-24376 · Safe · Fme Server

Name of the Vulnerable Software and Affected Versions: Safe Software FME Server versions prior to v2022.0.1.1 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login page, specifically through a cross-site scripting XSS...

CVE-2022-3235

Use After Free in GitHub repository vim/vim prior to 9.0.0490...

CVE-2022-3234

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483...

CVE-2022-3232 Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb

Cross-Site Request Forgery CSRF in GitHub repository ikus060/rdiffweb prior to 2.4.5...

CVE-2022-3231

Cross-site Scripting XSS - Stored in GitHub repository librenms/librenms prior to 22.9.0...

PT-2022-34576 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.9.326 Description: The issue is related to a use-after-free error in the linkwatch on disconnect. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...