Design/Logic Flaw

The aprwrite function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using aprwrite or aprputs, such as with modluas r:puts function. Modules compiled and distributed separately from Apache HTTP Server that use t...

CVE-2022-28614

CVE-2022-28614 affects Apache HTTP Server 2.4.53 and earlier. The vulnerability stems from ap_rwrite() potentially reading unintended memory when reflecting very large input via ap_rwrite() or ap_rputs(), notably with mod_luas r:puts(). Modules compiled against older headers that use ap_rputs may...

CVE-2022-28330

Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the modisapi module...

CVE-2022-32275

Grafana 8.4.3 allows reading files via for example a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI. NOTE: the vendor's position is that there is no vulnerability; this request yields a benign error page, not /etc/passwd content...

CVE-2022-32275

Grafana 8.4.3 allows reading files via for example a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI. NOTE: the vendor's position is that there is no vulnerability; this request yields a benign error page, not /etc/passwd content...

CVE-2022-32275

Grafana 8.4.3 allows reading files via for example a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI. NOTE: the vendor's position is that there is no vulnerability; this request yields a benign error page, not /etc/passwd content...

CVE-2022-32275

Grafana 8.4.3 is listed as CVE-2022-32275 for a potential directory/traversal issue that could let an attacker read arbitrary files via crafted URLs such as /dashboard/snapshot/{...}/etc/passwd. The description notes the vendor’s position that there is no vulnerability and that the request yields...

CVE-2022-32275

Grafana 8.4.3 allows reading files via for example a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI. NOTE: the vendor's position is that there is no vulnerability; this request yields a benign error page, not /etc/passwd content...

Qualcomm 缓冲区错误漏洞

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way to miniaturize circuits mainly semiconductor devices, but also passive components, etc. and are often manufactured on the surface of semiconductor wafers. Qualcomm has a security vulnerability that stems from a boundary error in Vide...

Design/Logic Flaw

An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verifyurl option is disabled. This vulnerability is exploited via a crafted URL...

Horner Automation Cscape Csfont Out-of-Bounds Reading Vulnerability

Horner Automation Cscape is a programming software for industrial control system development from Horner Automation, Inc. An out-of-bounds read vulnerability exists in Horner Automation Cscape Csfont, which can be exploited by attackers to execute arbitrary code...

GHSA-5824-6JFV-XR3R Arbitrary file read in ginadmin

In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading. A patch is available on the master branch of the repository...

CLSA-2022-1653499822 Fix CVE(s): CVE-2022-0318

SECURITY UPDATE: Reading beyond the end of a line - debian/patches/CVE-2022-0318.patch: For block insert only use the offset for correcting the length, adjust expected output of the relevant UTF8 block insertion test - CVE-2022-0318...

CVE-2022-30428

In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading...

CVE-2022-30428

In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading...

CVE-2022-30428

In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading...

Design/Logic Flaw

In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading...

CVE-2022-30428

CVE-2022-30428 affects ginadmin (up to 05-10-2022). The vulnerability arises from an unfiltered incoming path value, allowing an arbitrary file read from the server. Affected component appears to be the admin/system handling path input; the issue enables access to sensitive files, as described co...

CVE-2022-30428

In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading...

ginadmin 安全漏洞

ginadmin is a backend management platform based on the Gin framework for individual GPER developers in China. A security vulnerability exists in ginadmin 05-10-2022 and earlier versions, which stems from an unfiltered incoming path value, leading to arbitrary file reading...