Z-Wave 安全漏洞

Z-Wave is a wireless communication protocol used primarily for home automation. It is a mesh network that uses low-power radio waves to communicate from device to device to wirelessly control appliances and other devices in the home, such as controlling lighting, security systems, thermostats,...

CVE-2022-22121

In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability Formula Injection. A low privileged attacker can create a new table to inject payloads in the table rows. When an administrator accesses the User Management endpoint and exports the data as a CSV file and opens...

ToTolink Ex200 Command Injection Vulnerability

ToTolink Ex200 is a 2.4G wireless N-range extender from ToTolink China. It is designed to extend the coverage of existing Wi-Fi networks and eliminate "blind spots". The ToTolink Ex200 suffers from a command injection vulnerability, which arises from the failure of a network system or product to...

Additional Log Injection in Spring Framework (follow-up to CVE-2021-22096)

In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more...

CVE-2022-22116

In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting XSS vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victim’s browser when they open the image...

CVE-2021-30289

Possible buffer overflow due to lack of range check while processing a DIAG command for COEX management in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables...

Buffer overflow

Possible buffer overflow due to lack of range check while processing a DIAG command for COEX management in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables...

CVE-2021-30289

CVE-2021-30289 is a buffer overflow risk in Qualcomm Snapdragon components related to COEX management, triggered by processing a DIAG command. Connected sources robustly map affected products to Snapdragon families including Snapdragon Auto, Compute, Consumer IOT, Industrial IOT, Mobile, Voice & ...

CVE-2021-30289

Possible buffer overflow due to lack of range check while processing a DIAG command for COEX management in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables...

PT-2022-11334 · Unknown +1 · Checkmk Raw Edition +1

Name of the Vulnerable Software and Affected Versions: CheckMK Raw Edition software versions 1.5.0 through 1.6.0 Description: The issue allows for Reflected XSS, enabling an attacker to inject malicious HTML content, including JavaScript or other client-side scripts, into a user's browser. This...

CVE-2021-45944

Ghostscript GhostPDL 9.50 through 9.53.3 has a use-after-free in sampleddatasample called from sampleddatacontinue and interp...

PT-2025-8061

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock issue has been identified in the Linux kernel, specifically in the drm/amdkfd component. The problem occurs when the svm range restore work is flushed during process exit,...

CVE-2020-29292

iBall WRD12EN 1.0.0 devices allow cross-site request forgery CSRF attacks as demonstrated by enabling DNS settings or modifying the range for IP addresses...

CVE-2020-29292: Cross-Site Request Forgery (CSRF)

iBall WRD12EN 1.0.0 devices allow cross-site request forgery CSRF attacks as demonstrated by enabling DNS settings or modifying the range for IP addresses...

Ifme 跨站脚本漏洞

Ifme is open source a mental health experience community that encourages people to share their personal stories with trusted allies. Ifme suffers from a cross-site scripting vulnerability in versions v1.0.0 through v7.31.4, which stems from a lack of checksum filtering of user-supplied and output...

Ifme 跨站脚本漏洞

Ifme is open source a mental health experience community that encourages people to share their personal stories with trusted allies. A cross-site scripting vulnerability exists in ifme that stems from the product's markdown editor not doing valid validation of input data. An attacker could trigge...

Keycloak: Incorrect authorization allows unpriviledged users to create other users

A flaw was found in Keycloak version from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled...

CLSA-2021-1639681852 Fix CVE(s): CVE-2021-3872, CVE-2021-3875, CVE-2021-3903

SECURITY UPDATE: illegal memory access if buffer name is very long - debian/patches/CVE-2021-3872.patch: make sure not to go over the end of the buffer in screen.c - CVE-2021-3872 SECURITY UPDATE: mlget error after search with range - debian/patches/CVE-2021-3875.patch: limit the line number to t...

CLSA-2021-1639681626 Fix CVE(s): CVE-2021-2388

Fix CVE-2021-2388 OpenJDK: Incorrect comparison during range check elimination...

CLSA-2021-1639681613 Fix CVE(s): CVE-2021-2388

Fix CVE-2021-2388 OpenJDK: Incorrect comparison during range check elimination Add JDK-8165323.diff: fs Files.getFileStore fails with "Mount point not found" in chroot environment...