11002 matches found
PT-2022-16145 · Blitz.Js +1 · Blitz.Js +1
Name of the Vulnerable Software and Affected Versions: superjson versions prior to 1.8.1 Blitz.js versions prior to 0.45.3 Description: The issue allows input to run arbitrary code on any server using superjson input without prior authentication or knowledge. The only requirement is that the serv...
PT-2022-16134 · Unknown · Xwiki Platform
Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 13.6-rc-1 Description: The issue arises from the AbstractSxExportURLFactoryActionHandlerprocessSx function not properly escaping SSX document references when serializing them on the filesystem. This allows the...
mruby 缓冲区错误漏洞
mruby is a lightweight implementation of the Ruby language. A security vulnerability exists in versions of Homebrew mruby prior to 3.2 that originates when a networked system or product performs an operation in memory without properly validating data boundaries, resulting in an incorrect read or...
CVE-2022-0524 Business Logic Errors in publify/publify
Business Logic Errors in GitHub repository publify/publify prior to 9.2.7...
CVE-2022-0518
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.2...
CVE-2022-0139
Use After Free in GitHub repository radareorg/radare2 prior to 5.6.0...
CVE-2022-0510
Cross-site Scripting XSS - Reflected in Packagist pimcore/pimcore prior to 10.3.1...
CVE-2021-23288
The vulnerability exists due to insufficient validation of input from certain resources by the IPP software. The attacker would need access to the local Subnet and an administrator interaction to compromise the system. This issue affects: Intelligent Power Protector versions prior to 1.69...
CVE-2022-0505 Cross-Site Request Forgery (CSRF) in microweber/microweber
Cross-Site Request Forgery CSRF in Packagist microweber/microweber prior to 1.2.11...
PT-2022-12321 · Gitea · Gitea
Name of the Vulnerable Software and Affected Versions: Gitea versions prior to 1.5.1 Description: A Cross Site Scripting XSS issue exists in the repository settings, specifically inside the external wiki/issue tracker URL field. This allows for potential exploitation. No information is provided...
PT-2022-6497 · Unknown +4 · Zoneminder +4
Name of the Vulnerable Software and Affected Versions: ZoneMinder versions prior to 1.36.13 Description: The issue is related to incorrect restriction of a directory path with limited access in ZoneMinder, a video surveillance software. This can be exploited by a remote attacker to execute...
PT-2022-13238 · Rubygems +1 · Rubygems +1
Name of the Vulnerable Software and Affected Versions: Publify versions prior to 9.2.7 Description: The issue concerns business logic errors in the Publify repository. This affects the Rubygems typo package as well. There is no information provided about the estimated number of potentially affect...
PT-2022-15626 · Synology · Synology Diskstation Manager
Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 7.0.1-42218-2 Description: The issue allows remote attackers to obtain sensitive information via unspecified vectors, resulting in the exposure of sensitive information to unauthorized actors...
Wordpress Plugin SupportCandy 跨站请求伪造漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an open source application plugin for WordPress. A cross-site request forgery vulnerability...
PT-2022-11938 · Synology · Synology Diskstation Manager
Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 7.0.1-42218-2 Description: The issue is related to the improper neutralization of special elements in output used by a downstream component, also known as an 'Injection' vulnerability, in the...
CVE-2022-0501
Cross-site Scripting XSS - Reflected in Packagist ptrofimov/beanstalkconsole prior to 1.7.12...
CVE-2022-22726
A CWE-20: Improper Input Validation vulnerability exists that could allow arbitrary files on the server to be read by authenticated users through a limited operating system service account. Affected Product: EcoStruxure Power Monitoring Expert Versions 2020 and prior...
CVE-2022-0264
A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating som...