CVE-2022-27618

Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in webapi component in Synology Storage Analyzer before 2.1.0-0390 allows remote authenticated users to delete arbitrary files via unspecified vectors...

PT-2022-18523 · Synology · Synology Storage Analyzer

Name of the Vulnerable Software and Affected Versions: Synology Storage Analyzer versions prior to 2.1.0-0390 Description: The issue is related to a Path Traversal vulnerability in the webapi component, allowing remote authenticated users to delete arbitrary files via unspecified vectors...

Vinchin Backup and Recovery 信任管理问题漏洞

Vinchin Backup and Recovery is an easy-to-use, safe and reliable virtual machine data protection software from China Yunqi Technology Vinchin. It is used for backup and recovery. Vinchin Backup and Recovery version 6.5.0.17561 suffers from a trust management issue vulnerability that stems from...

CVE-2022-22684

Improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability in task management component in Synology DiskStation Manager DSM before 6.2.4-25553 allows remote authenticated users to execute arbitrary commands via unspecified vectors...

CVE-2022-27613

Improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in webapi component in Synology CardDAV Server before 6.0.10-0153 allows remote authenticated users to inject SQL commands via unspecified vectors...

CVE-2022-27611

Summary: CVE-2022-27611 is a path traversal vulnerability in the Synology Audio Station webapi component. An improper limitation of a pathname to a restricted directory enables remote authenticated users to delete arbitrary files via unspecified vectors. Affected product/version: Synology Audio S...

Path traversal

Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in cgi component in Synology DNS Server before 2.2.2-5027 allows remote authenticated users to delete arbitrary files via unspecified vectors...

CVE-2022-22686

Cross-Site Request Forgery CSRF vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to hijack the authentication of administrators via unspecified vectors...

CVE-2022-26136

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and...

CVE-2022-22360

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability and could result in in granting permission to unauthorized resources...

CVE-2022-27661

Operation restriction bypass vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Workflow...

CVE-2022-26368

CVE-2022-26368 is a vulnerability in Cybozu Garoon's Cabinet component (versions 4.0.0 to 5.5.1) described as a browse restriction bypass and operation restriction bypass (CWE-285). The issue allows a remote authenticated attacker to alter and/or obtain data stored in Cabinet. It is associated wi...

PT-2022-18558 · Cybozu · Cybozu Garoon

Name of the Vulnerable Software and Affected Versions: Cybozu Garoon versions 4.0.0 through 5.5.1 Description: The issue allows a remote authenticated attacker to bypass operation restrictions in the Workflow of Cybozu Garoon and alter the data of Workflow. Recommendations: For Cybozu Garoon...

CVE-2022-28620

A remote authentication bypass vulnerability was discovered in HPE Cray Legacy Shasta System Solutions; HPE Slingshot; and HPE Cray EX supercomputers versions: Prior to node controller firmware associated with HPE Cray EX liquid cooled blades, and all versions of chassis controller firmware...

CVE-2022-28620

A remote authentication bypass vulnerability was discovered in HPE Cray Legacy Shasta System Solutions; HPE Slingshot; and HPE Cray EX supercomputers versions: Prior to node controller firmware associated with HPE Cray EX liquid cooled blades, and all versions of chassis controller firmware...

Authentication flaw

A remote authentication bypass vulnerability was discovered in HPE Cray Legacy Shasta System Solutions; HPE Slingshot; and HPE Cray EX supercomputers versions: Prior to node controller firmware associated with HPE Cray EX liquid cooled blades, and all versions of chassis controller firmware...

CVE-2022-28620

CVE-2022-28620 is a remote authentication bypass affecting HPE Cray Legacy Shasta System Solutions, HPE Slingshot, and HPE Cray EX supercomputers. Affected firmware/versions include: node controller firmware for HPE Cray EX liquid-cooled blades; chassis controller firmware in HPE Cray EX liquid-c...

Default credentials

In multiple CODESYS products, file download and upload function allows access to internal files in the working directory e.g. firmware files of the PLC. All requests are processed on the controller only if no level 1 password is configured on the controller or if remote attacker has previously...

PT-2022-19108 · Hewlett Packard · Hpe Cray Ex Supercomputers +2

Name of the Vulnerable Software and Affected Versions: HPE Cray Legacy Shasta System Solutions versions prior to node controller firmware associated with HPE Cray EX liquid cooled blades HPE Slingshot versions prior to 1.7.2 HPE Cray EX supercomputers versions prior to 1.6.27/1.5.33/1.4.27...

CVE-2021-40604

A Server-Side Request Forgery SSRF vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases an exploitation is possible by an unauthenticated us...