UBUNTU-CVE-2021-32473

It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected...

CVE-2022-26104

SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messages, resulting for an unauthorized user to alter the maintenance system message...

Quicklert SQL注入漏洞

Quicklert is an easy-to-use messaging, alerting, and emergency response solution from Quicklert USA, Inc. Quicklert for Digium version 10.0.0 is vulnerable to SQL injection, which originates from the login.jsp page. The vulnerability stems from the application's lack of validation of externally...

Microsoft Windows Media Foundation 缓冲区错误漏洞

Microsoft Windows Media Foundation is a multimedia development library from Microsoft that aims to provide a unified multimedia solution for the Windows platform, allowing developers to play video and sound files, encode audio and video, or transcode multimedia files. Developers can use Media...

Microsoft SMBv3 代码注入漏洞

Microsoft SMBv3 is a support firmware from Microsoft Corporation USA that provides SMB functionality for devices. A code injection vulnerability exists in Microsoft SMBv3 Client/Server. The following products and versions are affected: Windows 10 Version 21H1 for x64-based Systems,Windows 10...

Microsoft DWM Core Library 权限许可和访问控制问题漏洞

The Microsoft DWM Core Library is a core library for Microsoft windows from Microsoft Corporation. A vulnerability exists in the Microsoft DWM Core Library due to permission and access control issues. The following products and editions are affected: Windows 10 Version 20H2 for x64-based Systems,...

Microsoft Windows Update 竞争条件问题漏洞

Microsoft Windows Update is a program update service from Microsoft Corporation USA. A vulnerability exists in the Microsoft Windows Update Stack due to a competitive condition issue. Windows 11 for ARM64-based Systems,Windows 10 Version 21H2 for 32-bit Systems,Windows 10 Version 21H2 for...

Microsoft Windows Event Tracing 代码注入漏洞

Microsoft Windows Event Tracing is an application from Microsoft Corporation USA. It provides a mechanism to track and log events raised by user-mode applications and kernel-mode drivers. A code injection vulnerability exists in Microsoft Windows Event Tracing. The following products and editions...

Google Android 资源管理错误漏洞

Google Android is a Linux-based open source operating system from Google. A denial of service vulnerability exists in Google Android prior to Framework 10, 11, and 12. The vulnerability stems from a failure to properly handle incoming error messages, which can be exploited by an attacker to cause...

CVE-2022-0838

Cross-site Scripting XSS - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.10...

CVE-2021-3967

Improper Access Control in GitHub repository zulip/zulip prior to 4.10...

CVE-2021-46702

Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could allow local attackers to bypass the intended anonymity feature and obtain information regarding the onion services visited by a local user. This can be accomplished by analyzing RAM memory even several...

virt:kvm_utils security update

hivex 1.3.18-21 - Bounds check for block exceeding page length CVE-2021-3504 resolves: rhbz1950501 libguestfs 1.40.2-28.0.1 - Replace upstream references from description tag - Config supermin to use host yum.conf in ol8 Orabug: 29319324 - Set DISTROORACLELINUX correspeonding to ol 1:1.40.2-28 -...

CVE-2022-0665

Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2...

CVE-2021-46650

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...

CVE-2021-46597

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

DEBIAN-CVE-2022-25258

An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests ones with a large array index and ones associated with NULL function pointer retrieval. Memory corruption might occur...

Linux kernel 安全漏洞

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel 5.16.10 and earlier versions have a security vulnerability that could be exploited by attackers to execute arbitrary code on the system...

CVE-2022-24227

A cross-site scripting XSS vulnerability in BoltWire v7.10 and v 8.00 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the name and lastname parameters...

PT-2022-17133 · Jenkins · Jenkins Snow Commander Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Snow Commander Plugin versions 1.10 and earlier Description: The issue concerns missing permission checks in the Jenkins Snow Commander Plugin, allowing attackers with Overall/Read permission to connect to a specified webserver using...