Bender ebee 充电控制器 安全漏洞

The ebee is a charge controller from Bender. A security vulnerability exists in the Bender ebee Charge Controller that stems from an unprotected data export. The backup export is protected by a random key. The key is set at user login. It is empty after a reboot. An attacker can exploit this...

DEBIAN-CVE-2022-29264

An issue was discovered in coreboot 4.13 through 4.16. On APs, arbitrary code execution in SMM may occur...

UBUNTU-CVE-2022-24841

fleetdm/fleet is an open source device management, built on osquery. All versions of fleet making use of the teams feature are affected by this authorization bypass issue. Fleet instances without teams, or with teams but without restricted team accounts are not affected. In affected versions a te...

CVE-2022-26151

Citrix XenMobile Server 10.12 through RP11, 10.13 through RP7, and 10.14 through RP4 allows Command Injection...

PT-2022-17697 · Citrix · Citrix Xenmobile Server

Name of the Vulnerable Software and Affected Versions: Citrix XenMobile Server versions 10.12 through RP11 Citrix XenMobile Server versions 10.13 through RP7 Citrix XenMobile Server versions 10.14 through RP4 Description: The issue allows Command Injection. Recommendations: For versions 10.12...

Citrix XenMobile Server 命令注入漏洞

Citrix Systems Citrix XenMobile Server is a mobility management solution from Citrix Systems. The solution enables the management of mobile devices, the development of mobile policies and compliance rules, and insight into the operation of mobile cellular networks. A command injection vulnerabili...

Samsung Members 安全漏洞

Samsung Members is a community platform app from Samsung South Korea, Inc. An access control error vulnerability exists in versions prior to Samsung Members 13.6.08.5, which stems from a lack of proper access validation logic. A local attacker could exploit the vulnerability to execute the call...

The vulnerability of TLS and SSL Mbed TLS implementations lies in the transmission of encrypted-protected information in an unencrypted form, allowing attackers to gain access to confidential data.

The vulnerability of TLS and SSL Mbed TLS implementations lies in the fact that the countermeasure “Lucky 13” does not correctly handle cases involving hardware acceleration. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...

p0insettia

It is an offensive tool for iOS jailbreak. The tool, named p0insettia, is designed to perform a tethered jailbreak on iOS 10.3.4 32-bit devices, specifically the iPhone 5, using the checkm8 BootROM exploit. The tool is written in C and uses the libcurl library for network operations. The code is...

UBUNTU-CVE-2021-4191

An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Private GitLab instances with restricted sign-ups may be vulnerable to user enumeration to unauthenticated users through the GraphQL API...

CVE-2022-26263

Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting XSS vulnerability via the component /u8sl/WebHelp...

CVE-2022-25267

Passwork On-Premise Edition before 4.6.13 allows migration/uploadExportFile Directory Traversal to upload files...

CVE-2022-25268

Passwork On-Premise Edition before 4.6.13 allows CSRF via the groups, password, and history subsystems...

CVE-2022-0862

A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy Orchestrator ePO prior to 5.10 Update 13 allows a remote attacker to change the password of a compromised session without knowing the existing user's password. This functionality was removed from...

PT-2022-13476 · Mcafee · Mcafee Enterprise Epolicy Orchestrator

Name of the Vulnerable Software and Affected Versions: McAfee Enterprise ePolicy Orchestrator versions prior to 5.10 Update 13 Description: A reflected cross-site scripting issue allows a remote attacker to potentially obtain access to an administrator's session by convincing them to click on a...

CVE-2022-22606

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution...

CVE-2022-22603

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution...

CVE-2022-22607

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution...

CVE-2022-27201

Jenkins Semantic Versioning Plugin 1.13 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses externa...

PT-2022-18293 · Jenkins · Jenkins Gitlab Authentication Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins GitLab Authentication Plugin versions 1.13 and earlier Description: The issue concerns the storage of the GitLab client secret in an unencrypted form within the global config.xml file on the Jenkins controller. This allows users with...