XXL-JOB 跨站脚本漏洞

XXL-JOB is a java-based distributed task scheduling platform from the XXL XXL-JOB community. xxl-job version 2.3.0 is vulnerable to a cross-site scripting vulnerability. An attacker can exploit this vulnerability to execute JavaScript programs...

CVE-2022-30820

creationtimestamp| type| source ---|---|--- 2022-06-02 18:25:55+00:00| seen| https://t.me/cibsecurity/43666...

GHSA-9RR5-Q43R-CCV4 Mattermost Server does not prevent System Admin from arbitrary file creation

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files...

GHSA-G3F3-P9RC-775P Mattermost Server exposes account details to any Team Administrator

An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details...

GHSA-J26G-95PH-2MWV Mattermost Server: Insufficient Password-Reset Link Invalidation

An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused...

GHSA-43M6-WVC8-2M7J Mattermost Server's Session ID and Session Token are potentially compromised

An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled...

CVE-2022-30551

creationtimestamp| type| source ---|---|--- 2022-05-20 16:36:40+00:00| seen| https://t.me/cibsecurity/43049...

CVE-2022-29882

A vulnerability has been identified in SICAM T All versions V3.0. Affected devices do not handle uploaded files correctly. An unauthenticated attacker could take advantage of this situation to store an XSS attack, which could - when a legitimate user accesses the error logs - perform arbitrary...

CVE-2022-29877

A vulnerability has been identified in SICAM P850 All versions V3.00, SICAM P850 All versions V3.00, SICAM P850 All versions V3.00, SICAM P850 All versions V3.00, SICAM P850 All versions V3.00, SICAM P850 All versions V3.00, SICAM P850 All versions V3.00, SICAM P850 All versions V3.00, SICAM P850...

CVE-2022-30688

creationtimestamp| type| source ---|---|--- 2022-05-17 22:27:47+00:00| seen| https://t.me/cibsecurity/42852...

CVE-2022-1731

Metasonic Doc WebClient 7.0.14.0 / 7.0.12.0 / 7.0.3.0 is vulnerable to a SQL injection attack in the username field. SSO or System authentication are required to be enabled for vulnerable conditions to exist...

CVE-2022-30412

Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/admin/individuals/updatestatus.php?id=...

CVE-2022-29307

creationtimestamp| type| source ---|---|--- 2022-05-12 20:42:16+00:00| seen| https://t.me/cibsecurity/42528...

DEBIAN-CVE-2022-24891

ESAPI The OWASP Enterprise Security API is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the antisamy-esapi.xml configurati...

Liferay Portal和Liferay DXP 跨站脚本漏洞

Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...

CVE-2022-22559

Dell PowerScale OneFS, version 9.3.0, contains a use of a broken or risky cryptographic algorithm. An unprivileged network attacker could exploit this vulnerability, leading to the potential for information disclosure...

PT-2022-2609

Name of the Vulnerable Software and Affected Versions Ruby versions 2.6.0 through 2.6.9 Ruby versions 2.7.x through 2.7.5 Ruby versions 3.0.0 through 3.0.3 Ruby versions 3.1.0 through 3.1.1 Description The issue is related to a buffer over-read in Ruby, specifically in String-to-Float conversion,...

CVE-2021-41026

A relative path traversal in FortiWeb versions 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests...

PT-2022-16891 · Combodi +1 · Combodo Itop +1

Name of the Vulnerable Software and Affected Versions: Combodi iTop versions prior to 2.7.6 and 3.0.0 Description: Combodi iTop is a web-based IT Service Management tool. The issue allows for cross-site scripting for scripts outside of script tags when displaying HTML attachments. There are...

PT-2022-3899 · General Electric · Inet +1

Name of the Vulnerable Software and Affected Versions: General Electric Renewable Energy iNET and iNET II versions prior to 8.3.0 Description: The issue is related to inadequate encryption strength in the software of General Electric Renewable Energy's iNET and iNET II products. This could allow ...