Bender ebee 充电控制器 操作系统命令注入漏洞

The ebee is a charge controller from Bender. The Bender ebee Charge Controller suffers from an operating system command injection vulnerability that stems from easy command injection via the web interface. An authenticated attacker could enter shell commands into certain input fields executed wit...

Nextcloud Android app 授权问题漏洞

Nextcloud Android app is an Android-based mobile application from Nextcloud Germany for accessing Nextcloud servers. nextcloud Android app versions prior to 3.19.1 contain an access control error vulnerability that stems from improper access control, which is exploited by An authenticated attacke...

Redis Labs Redis 代码问题漏洞

Redis Labs Redis is the United States Redis Labs, Inc. of a set of open-source use of ANSI C written to support the network , can be based on the memory can also be a persistent log-type , key-value Key-Value storage database , and provides a variety of languages API. A security vulnerability...

CVE-2022-23942 Apache Doris hardcoded cryptography initialization

Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure...

GHSA-8WP2-VXPG-XCVP Cross site scripting in facturascripts

facturasripts is an open source ERP software. Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can...

FreeRDP 安全漏洞

FreeRDP is an open source implementation of the Remote Desktop Protocol RDP from the FreeRDP team. A security vulnerability exists in FreeRDP that stems from the fact that in versions prior to 2.7.0, NT LAN Manager NTLM authentication does not abort correctly when someone provides and empty...

Google Go has an unspecified vulnerability (CNVD-2022-55213)

Google Go is a statically strongly typed, compiled, concurrent, and garbage collected programming language from Google Google, U.S.A. A vulnerability exists in versions of Google Go prior to 1.17.9 and prior to 1.18.1, which stems from the generic P-256 feature in crypto/elliptic allowing long...

PT-2022-2582 · Apache · Apache Couchdb

Name of the Vulnerable Software and Affected Versions: Apache CouchDB versions prior to 3.2.2 Description: The issue concerns an improperly secured default installation of Apache CouchDB, allowing an attacker to access the system without authentication and gain admin privileges. The CouchDB...

PT-2022-6776 · Google +1 · Google Chrome +1

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 101.0.4951.41 Description: A heap buffer overflow issue in the Blink component of Google Chrome allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page, if the user is convinced...

Gibbon 代码问题漏洞

Gibbon is a school platform that solves real-world problems that educators encounter every day. A security vulnerability exists in Gibbon version v3.4.4 and prior versions. An attacker performs server-side request forgery SSRF via a crafted URL...

FacturaScripts 跨站脚本漏洞

FacturaScripts is an open source ERP software from the individual developer Carlos Garcia in Spain. A cross-site scripting vulnerability exists in NeoRazorX FacturaScripts versions prior to 2022.04, which stems from a lack of filtering and escaping of the title parameter executed on the EditUser...

OpenEMR 安全漏洞

OpenEMR is an open source medical management system from the Openemr community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A security vulnerability exists in versions of OpenEMR prior to 6.1.0.1, which can...

CVE-2022-1437

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash...

AZL-9580 CVE-2022-27405 affecting package freetype for versions less than 2.12.1-1

FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNTSizeRequest...

Lenovo PCManager 代码问题漏洞

Lenovo Lenovo Pcmanager Lenovo Computer Manager is a software from Lenovo, China that allows for comprehensive management of Pc devices. A security vulnerability exists in versions prior to Lenovo Pcmanager 4.0.40.2175, which stems from a DLL search path vulnerability in the application. An...

UBUNTU-CVE-2022-28367

OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets CSS content...

CVE-2022-0272

Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0...

USN-5326-1: FUSE vulnerabilities | Cloud Foundry

Severity Unknown Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Description It was discovered that FUSE is susceptible to a restriction bypass flaw on a system that has SELinux active. A local attacker with non-root privileges could mount a FUSE file system that is accessible to...

PT-2022-19681 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP versions prior to 2.4.158 Description: An issue was discovered in the event graph via a tag name, allowing stored XSS. Recommendations: For versions prior to 2.4.158, update to version 2.4.158 or later to resolve the issue. As a temporar...

PT-2022-19678 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP versions prior to 2.4.158 Description: An issue was discovered in MISP where PHAR deserialization can occur. Recommendations: For versions prior to 2.4.158, update to version 2.4.158 or later to resolve the issue...