6262 matches found
Oracle Linux 8 : ruby:2.5 (ELSA-2022-0672)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-0672 advisory. - Properly fix command injection vulnerability in Rdoc. Related: CVE-2021-31799 - Fix command injection vulnerability in RDoc. Resolves: CVE-2021-31799...
Design/Logic Flaw
Simulation models for KUKA.Sim Pro version 3.1 are hosted by a server maintained by KUKA. When these devices request a model, the server transmits the model in plaintext...
Cybonet PineApp Mail Secure 安全漏洞
Cybonet PineApp Mail Secure is Israel's Cybonet's ability to block most malicious email threats at the network perimeter while providing a range of additional options for comprehensive security and message control. Cybonet PineApp Mail Secure Relay suffers from a security vulnerability that can b...
Command Execution Vulnerability in Notable
Notable is a Markdown-based note-taking software with cross-platform support. Notable suffers from a command execution vulnerability that can be exploited by an attacker to gain control of the server...
Cobbler 加密问题漏洞
Cobbler is a network installation server suite that is primarily used to quickly build Linux network installation environments. a security vulnerability exists in Cobbler that stems from routines in some files that use the HTTP protocol instead of the more secure HTTPS. no details of the...
CVE-2022-22899
Core FTP / SFTP Server v2 Build 725 was discovered to allow unauthenticated attackers to cause a Denial of Service DoS via a crafted packet through the SSH service...
log4j: Unsafe deserialization flaw in Chainsaw log viewer
A flaw was found in the log4j 1.x chainsaw component, where the contents of certain log entries are deserialized and possibly permit code execution. This flaw allows an attacker to send a malicious request with serialized data to the server to be deserialized when the chainsaw component is run...
com.adaptrex:adaptrex-core (>=0.9.13 <=1.0-Alpha3), com.adaptrex:adaptrex-sandbox-core (>=0.9.13 <=1.0-Alpha3) +82 more potentially affected by CVE-2022-24289 via org.apache.cayenne:cayenne-server (>=3.0M4 <=4.1.RC2)
org.apache.cayenne:cayenne-server MAVEN version =3.0M4, =0.9.13, =0.9.13, =0.9.13, =0.9.13, =0.12, =0.8, =0.6, =1.6, =1.7, =1.7, =1.14, =1.23, =2.11, =2.10, =0.6.0.2, =0.7.3 and more Source cves: CVE-2022-24289 Source advisory: OSV:GHSA-C58C-W527-H77P...
Design/Logic Flaw
superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows input to run arbitrary code on any server using superjson input without prior authentication or knowledge. The only requirement is that the server implements ...
CVE-2022-21968
Microsoft SharePoint Server Security Feature Bypass Vulnerability...
CVE-2022-21193
Directory traversal vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to obtain an arbitrary file on the server via unspecified vectors...
Vulnerabilities fixed in Microsoft SQL Server and Power BI
Microsoft has fixed vulnerabilities in Microsoft SQL Server and Power BI. The vulnerabilities allow a malicious party to obtain elevated user privileges. SQL Server: |----------------|------|-------------------------------------| | CVE ID | CVSS | Impact |...
CVE-2021-24947
WordPress RVM – Responsive Vector Maps plugin (versions
Siemens SIMATIC S7-1500 Cross-site Scripting (CVE-2014-2246)
Cross-site scripting XSS vulnerability in the integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. This plugin only works with Tenable.ot. Please visit...
Sealevel Systems SeaConnect 370w 安全漏洞
Sealevel Systems SeaConnect 370W is an Industrial Internet of Things Iiot edge device from Sealevel Systems, Inc. used to remotely monitor and control the status of actual I/O processes. Sealevel Systems SeaConnect 370W is vulnerable to an information disclosure vulnerability caused by a possible...
CVE-2021-43848 Unititialized memory access in h2o
h2o is an open source http server. In code prior to the 8c0eca3 commit h2o may attempt to access uninitialized memory. When receiving QUIC frames in certain order, HTTP/3 server-side implementation of h2o can be misguided to treat uninitialized memory as HTTP/3 frames that have been received. Whe...
The vulnerability of the FTP server vsftpd, which stems from the lack of protection for transmitted data, allows attackers to carry out “man-in-the-middle” attacks.
The vulnerability of the FTP server vsftpd is related to the lack of protection for the data being transmitted. Exploiting this vulnerability allows a malicious actor to carry out a “man-in-the-middle” attack...
CVE-2021-23195 Fresenius Kabi Agilia Connect Infusion System exposure of information through directory listing
Fresenius Kabi Vigilant Software Suite Mastermed Dashboard version 2.0.1.3 has the option for automated indexing directory listing activated. When accessing a directory, a web server delivers its entire content in HTML form. If an index file does not exist and directory listing is enabled, all...
CVE-2022-21265
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...