CVE-2022-21594 vulnerabilities

Vulnerabilities for packages: mysql...

CVE-2022-42188

In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server...

PT-2022-37670 · Belden · Hirschmann

Уязвимость программного обеспечения управления сетью Hirschmann Industrial HiVision связана с возможностью обхода пути. Эксплуатация уязвимости может позволить нарушителю выполнить произвольный код...

PT-2022-21872 · Hiwin · Hiwin Robot System

Name of the Vulnerable Software and Affected Versions: HIWIN Robot System Software version 3.3.21.9869 Description: The issue arises from the software's failure to properly address the terminated command source. This allows an attacker to craft code that can disconnect the HIWIN Robot System...

DLA-3152-1 glibc - security update

Bulletin has no description...

CVE-2022-3293

Email addresses were leaked in WebHook logs in GitLab EE affecting all versions from 9.3 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1...

GHSA-4VJ2-426R-JM3G Magento Open Source allows Stored Cross-Site Scripting (Stored XSS)

Adobe Commerce versions 2.4.3-p3 and earlier, 2.4.4-p1 and earlier and 2.4.5 and earlier are affected by a Stored Cross-site Scripting vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution...

SUSE-SU-2022:3590-1 Security update for python-Babel

This update for python-Babel fixes the following issues: - CVE-2021-42771: Fixed relative path traversal bsc1185768...

CVE-2022-24697 Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters

Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the comma...

SQL Injection

CodeIgniter is vulnerable to sql injection. The vulnerability exists due to improper implementation of having function of DBquerybuilder.php which allows an attacker to inject and execute malicious sql queries in the system...

CVE-2022-40047

Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting XSS vulnerability via the page parameter at /flatpress/admin.php...

CVE-2022-40494

NPS before v0.26.10 was discovered to contain an authentication bypass vulnerability via constantly generating and sending the Auth key and Timestamp parameters...

Want More Secure Software? Start Recognizing Security-Skilled Developers

Professional developers want to do the right thing, but in terms of security, they are rarely set up for success. Organizations must support their upskilling with precision training and incentives if they want secure software from the ground up. The cyber threat landscape grows more complex by th...

ASB-A-205570663

In avrcctrlparsvendorrsp of avrcparsct.cc, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-238103939

Bulletin has no description...

ASB-A-234037216

In ims, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-238108282

Bulletin has no description...

DLA-3130-1 tinyxml - security update

Bulletin has no description...

CVE-2022-40315

A limited SQL injection risk was identified in the "browse list of users" site administration page...

Remote Code Execution (RCE)

redshift-jdbc42 is vulnerable to remote code execution. The vulnerability exists because the verifyPeerName function of MakeSSL.java does not properly check the class type when instantiating an object from a class name, allowing an attacker to inject and execute malicious code through the object...