Envoy 资源管理错误漏洞

Envoy is an open source distributed proxy server. versions prior to Envoy 1.22.1 are vulnerable to a resource management error, which stems from the fact that it is insecure to redirect requests with body text or trailers within Envoy, and an attacker could exploit the vulnerability to crash the...

PT-2022-19477 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.22.1 Description: The OAuth filter implementation in Envoy does not include a mechanism for validating access tokens. By design, when the HMAC signed cookie is missing, a full authentication flow should be triggered...

CVE-2022-2015 Cross-site Scripting (XSS) - Stored in jgraph/drawio

Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 19.0.2...

HPESBUX04323 rev.1 - HP-UX Common Internet File System (CIFS), Multiple Vulnerabilities

Potential Security Impact: Local: Compromise of System Integrity, Escalation of Privilege, Unauthorized Access, Unauthorized Disclosure of Information, Authentication Restriction Bypass; Remote: Compromise of System Integrity, Escalation of Privilege, Unauthorized Disclosure of Information,...

CVE-2022-30748

Unprotected dynamic receiver in Samsung Members prior to version 4.2.005 allows attacker to launch arbitrary activity...

CVE-2022-30735

Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the accesstoken without permission...

CVE-2022-30740

Improper auto-fill algorithm in Samsung Internet prior to version 17.0.1.69 allows physical attackers to guess stored credit card numbers...

Code injection

Unprotected dynamic receiver in Samsung Members prior to version 4.2.005 allows attacker to launch arbitrary activity...

CVE-2022-30720

Improper input validation check logic vulnerability in libsmkvextractor prior to SMR Jun-2022 Release 1 allows attackers to trigger crash...

CVE-2022-2022 Cross-site Scripting (XSS) - Stored in nocodb/nocodb

Cross-site Scripting XSS - Stored in GitHub repository nocodb/nocodb prior to 0.91.7...

CVE-2022-2022 Cross-site Scripting (XSS) - Stored in nocodb/nocodb

Cross-site Scripting XSS - Stored in GitHub repository nocodb/nocodb prior to 0.91.7...

PT-2022-20284 · Unknown · Quick Share

Name of the Vulnerable Software and Affected Versions: Quick Share versions prior to 13.1.2.4 Description: The issue is related to improper access control in Quick Share, allowing an attacker to access internal files. Recommendations: For versions prior to 13.1.2.4, update to version 13.1.2.4 or...

CVE-2022-2000

Out-of-bounds Write in GitHub repository vim/vim prior to 8.2...

CVE-2022-1997 Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis

Cross-site Scripting XSS - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0...

Google Android 缓冲区错误漏洞

Google Android is a Linux-based open source operating system from Google, Inc. in the United States. A buffer error vulnerability exists in System in Google Android versions prior to 10, 11, 12, and 12L. No information about this vulnerability is available at this time, so stay tuned to CNNVD or...

PT-2022-21350

Name of the Vulnerable Software and Affected Versions jmespath.rb versions prior to 1.6.1 Description The issue arises from jmespath.rb using JSON.load in a situation where JSON.parse is preferable, potentially leading to remote code execution. Recommendations For versions prior to 1.6.1, update ...

PT-2022-3098 · Cri-O +7 · Cri-O +7

Name of the Vulnerable Software and Affected Versions: CRI-O versions prior to 1.24.1 CRI-O versions prior to 1.23.3 CRI-O versions prior to 1.22.5 CRI-O versions prior to v1.21.8 CRI-O versions prior to v1.20.8 CRI-O versions prior to v1.19.7 Description: A vulnerability in CRI-O causes memory o...

PT-2022-4866 · Jetbrains · Intellij Idea

Name of the Vulnerable Software and Affected Versions: IntelliJ IDEA versions prior to 2022.2.2 Description: The issue is related to an uncontrolled search path element in the executable files of the IntelliJ IDEA integrated development environment installer. Exploitation of this issue may allow ...

CVE-2022-1987

Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11...

AlekSIS-Core 安全漏洞

AlekSIS-Core is a school information system from AlekSIS, Inc. A security vulnerability exists in AlekSIS-Core version v2.8.1 and prior versions, which stems from an access control issue in aleksis/core/util/authhelpers.py...