MingSoft MCMS SQL注入漏洞

MingSoft MCMS is a complete open source J2ee system from China's MingSoft. A SQL injection vulnerability exists in MingSoft MCMS version 5.2.8, which originates from a SQL injection vulnerability in the /mdiy/model/delete URI containing a SQL injection via models Lists...

MingSoft MCMS SQL注入漏洞

MingSoft MCMS is a complete open source J2ee system from China's MingSoft. A SQL injection vulnerability exists in MingSoft MCMS version 5.2.8, which originates from an attacker being able to exploit the fieldName parameter of its /mdiy/page/verify URI component to achieve SQL injection...

CVE-2022-2824

creationtimestamp| type| source ---|---|--- 2022-08-15 20:47:23+00:00| seen| https://t.me/cibsecurity/48165...

CVE-2022-2378

The Easy Student Results WordPress plugin through 2.2.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

WordPress plugin Easy Student Results 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2022-2804

creationtimestamp| type| source ---|---|--- 2022-08-13 00:34:05+00:00| seen| https://t.me/cibsecurity/48123...

Joplin 跨站脚本漏洞

Joplin is an open source notes and to-do list application. A security vulnerability exists in Joplin version v2.8.8, which stems from the fact that an attacker can execute arbitrary commands by injecting a crafted payload into a Node header...

CVE-2022-2287

creationtimestamp| type| source ---|---|--- 2022-07-03 02:40:53+00:00| seen| https://t.me/cibsecurity/45549...

CVE-2022-31943

MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability...

Wiris Mathtype 路径遍历漏洞

Wiris Mathtype is a Moodle plugin from the Spanish company Wiris. Convert any MathML or LaTeX to an accessible image using Wiris' MathType API service. A security vulnerability exists in Wiris Mathtype version v7.28.0, which stems from a path traversal issue included in the resourceFile parameter...

CVE-2021-42890

creationtimestamp| type| source ---|---|--- 2022-06-03 18:26:38+00:00| seen| https://t.me/cibsecurity/43819...

CVE-2022-29734

A cross-site scripting XSS vulnerability in ICT Protege GX/WX v2.08 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter...

PT-2022-19580 · Apache · Apache Archiva

Name of the Vulnerable Software and Affected Versions: Apache Archiva versions prior to 2.2.8 Description: The issue allows any registered user to reset the password for any other user. Recommendations: For versions prior to 2.2.8, update to version 2.2.8 to resolve the issue...

GHSA-CQMR-RCPR-CXH3 Ansible password prompts could expose passwords

ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them...

CVE-2022-29028

A vulnerability has been identified in JT2Go All versions V13.3.0.3, Teamcenter Visualization V13.3 All versions V13.3.0.3, Teamcenter Visualization V14.0 All versions V14.0.0.1. The TiffLoader.dll is vulnerable to infinite loop condition while parsing specially crafted TIFF files. An attacker...

PT-2022-19453

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.9.0 TensorFlow versions prior to 2.8.1 TensorFlow versions prior to 2.7.2 TensorFlow versions prior to 2.6.4 Description The implementation of tf.raw ops.QuantizedConv2D does not fully validate the input argument...

CVE-2022-0574

Improper Access Control in GitHub repository publify/publify prior to 9.2.8...

PT-2022-13270 · Publify · Publify

Name of the Vulnerable Software and Affected Versions: publify/publify versions prior to 9.2.8 Description: The issue concerns improper access control in the GitHub repository publify/publify. It allows anonymous users to leave comments on articles in draft mode, even though they cannot view thes...

CVE-2022-28438

creationtimestamp| type| source ---|---|--- 2022-04-22 00:33:09+00:00| seen| https://t.me/cibsecurity/41287...

CVE-2022-21414

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...