CVE-2023-45763

Cross-Site Request Forgery CSRF vulnerability in Taggbox plugin = 2.9 versions...

CVE-2023-25946

Authentication bypass vulnerability in Qrio Lock Q-SL2 firmware version 2.0.9 and earlier allows a network-adjacent attacker to analyze the product's communication data and conduct an arbitrary operation under certain conditions...

CVE-2023-31617

An issue in the dksetdelete component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service DoS via crafted SQL statements...

Ping Identity Windows PingId 注入漏洞

Ping Identity Windows PingId is a software from Ping Identity USA that provides security for applications. A security vulnerability exists in Ping Identity Windows PingId versions prior to 2.9 that stems from a username conflict issue that is triggered when two people with the same username are...

PT-2023-12349 · Openbmc · Openbmc

Name of the Vulnerable Software and Affected Versions: OpenBMC version 2.9 Description: The issue allows an attacker to cause a denial of service to the BMC via the netipmid IPMI lan+ interface by sending crafted IPMI messages. Recommendations: For OpenBMC version 2.9, consider restricting access...

dnsmasq 安全漏洞

dnsmasq is a lightweight DNS forwarding and DHCP and TFTP server written in C. It can be used to forward packets to and from the server. A security vulnerability exists in dnsmasq versions prior to 2.90, which stems from the EDNS.0 UDP packet size being set to 4096 when the actual size should be...

SUSE CVE-2018-1000013

Jenkins Release Plugin 2.9 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attackers to trigger release builds...

CVE-2023-24188

ureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function which allows for arbitrary files to be deleted...

CVE-2022-4681 Hide My WP < 6.2.9 - Unauthenticated SQLi

The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

jc21 NGINX Proxy Manager 操作系统命令注入漏洞

jc21 Nginx Proxy Manager is a graphical user interface for managing Nginx servers. A security vulnerability exists in jc21 NGINX Proxy Manager version 2.9.19 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary commands on the system...

PT-2023-15896 · Kaltura · Kaltura Mwembed

Name of the Vulnerable Software and Affected Versions: kaltura mwEmbed versions up to 2.91 Description: A problem was found in the Share Plugin component, specifically in the file modules/KalturaSupport/components/share/share.js. The issue allows for cross site scripting through the manipulation ...

Containous Traefik 日志信息泄露漏洞

Containous Traefik is a reverse proxy and load balancer from US-based Containous. A log information disclosure vulnerability exists in versions of Containous Traefik prior to 2.9.6, which stems from the display of an authorization header in its debug logs...

UBUNTU-CVE-2022-39347

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing path canonicalization and base path check for drive channel. A malicious server can trick a FreeRDP based client to read files outside the shared directory. This issue has been addressed in...

DEBIAN-CVE-2022-39317

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing a range check for input offset index in ZGFX decoder. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it. This issue has been addressed in versio...

DEBIAN-CVE-2022-39318

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input validation in urbdrc channel. A malicious server can trick a FreeRDP based client to crash with division by zero. This issue has been addressed in version 2.9.0. All users are advised to...

DEBIAN-CVE-2022-41877

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in drive channel. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version...

PT-2022-5608 · Freerdp +10 · Freerdp +10

Name of the Vulnerable Software and Affected Versions: FreeRDP versions prior to 2.9.0 Description: The issue is related to the FreeRDP implementation of the remote desktop protocol, where an attempt to add integers to too narrow types leads to the allocation of a buffer that is too small to hold...

org.apache.pulsar:pulsar-server-distribution (>=2.9.0 <=2.9.2) potentially affected by CVE-2022-33683 via org.apache.pulsar:pulsar-proxy (>=2.9.0 <=2.9.2)

org.apache.pulsar:pulsar-proxy MAVEN version =2.9.0, =2.9.0, =2.9.2 Source cves: CVE-2022-33683 Source advisory: OSV:GHSA-J3QW-G67Q-7M64...

clip-jax (=0.0.5) potentially affected by CVE-2022-35960 via tensorflow-cpu (=2.9.0)

tensorflow-cpu PYPI version =2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - clip-jax =0.0.5 Source cves: CVE-2022-35960 Source advisory: OSV:GHSA-V5XG-3Q2C-C2R4...

CVE-2022-1910

The Shortcodes and extra features for Phlox WordPress plugin before 2.9.8 does not sanitise and escape a parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting...