User after free in mrb_vm_exec in mruby/mruby

User after free in mrbvmexec in GitHub repository mruby/mruby prior to 3.2...

CVE-2022-0153 SQL Injection in forkcms/forkcms

SQL Injection in GitHub repository forkcms/forkcms prior to 5.11.1...

CVE-2022-1058

Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5...

CVE-2022-1058

Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5...

CVE-2022-0551

Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticated attacker with admin or import manager roles to execute unattended commands on the appliance using web server user privileges. This issue affects: Nozomi Networks Guardian...

CVE-2022-0145

Cross-site Scripting XSS - Stored in GitHub repository forkcms/forkcms prior to 5.11.1...

CVE-2022-1061

Heap Buffer Overflow in parseDragons in GitHub repository radareorg/radare2 prior to 5.6.8...

PT-2022-13554 · Pimcore · Pimcore/Data-Hub

Name of the Vulnerable Software and Affected Versions: pimcore/data-hub versions prior to 1.2.4 Description: The issue is related to stored Cross-site Scripting XSS in the pimcore/data-hub GitHub repository. This type of attack occurs when an application stores user input data without proper...

PT-2022-13255 · Nozomi Networks · Nozomi Networks Cmc +1

Name of the Vulnerable Software and Affected Versions: Nozomi Networks Guardian versions prior to 22.0.0 Nozomi Networks CMC versions prior to 22.0.0 Description: The issue is related to an Improper Input Validation vulnerability in the project file upload feature of Nozomi Networks Guardian and...

CVE-2022-25267

Passwork On-Premise Edition before 4.6.13 allows migration/uploadExportFile Directory Traversal to upload files...

CVE-2020-20096

Whatsapp iOS 2.19.80 and prior and Android 2.19.222 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages...

CVE-2021-4180

An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the wwwauthenticateuri parameter which is visible to all end users in configuration files. This would give sensitive...

PT-2022-4185 · Unknown +1 · Passwork On-Premise Edition +1

Name of the Vulnerable Software and Affected Versions: Passwork On-Premise Edition versions prior to 4.6.13 Description: The issue is related to incorrect restriction of the path name to a directory with limited access. This allows a remote attacker to upload arbitrary files to the system. The...

PT-2022-4188 · Unknown +1 · Passwork On-Premise Edition +1

Name of the Vulnerable Software and Affected Versions: Passwork On-Premise Edition versions prior to 4.6.13 Description: The issue is related to incorrect restriction of the path name to a directory with limited access. An attacker can exploit this by manipulating URL parameters to gain access to...

PT-2022-13466 · Mcafee · Mcafee Enterprise Epolicy Orchestrator

Name of the Vulnerable Software and Affected Versions: McAfee Enterprise ePolicy Orchestrator versions prior to 5.10 Update 13 Description: A blind SQL injection issue allows a remote authenticated attacker to potentially obtain information from the database, with the data obtained being dependen...

CVE-2022-27228

In the vote aka "Polls, Votes" module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code...

mysql: Server: DML unspecified vulnerability (CPU Apr 2021)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 5.7.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...

CVE-2022-0515 Cross-Site Request Forgery (CSRF) in crater-invoice/crater

Cross-Site Request Forgery CSRF in GitHub repository crater-invoice/crater prior to 6.0.4...

CVE-2022-0415

Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6...

PT-2022-9501 · WordPress · Advanced Contact Form 7 Db

Name of the Vulnerable Software and Affected Versions: Advanced Contact form 7 DB WordPress plugin versions prior to 1.8.7 Description: The issue allows any authenticated user to delete arbitrary files on the web server due to the lack of authorization and CSRF checks in the acf7 db edit scr file...