PT-2022-10169 · Moxa · Moxa Nport Iaw5000A-I/O

Name of the Vulnerable Software and Affected Versions: Moxa NPort IAW5000A-I/O series firmware versions 2.2 or earlier Description: The issue is related to improper input validation in the built-in web server, which may allow a remote attacker to execute commands. Recommendations: For Moxa NPort...

Android Enterprise: Allow cross file copy and paste policy not working as expected after Citrix Endpoint Management upgraded to 22.2.0 (or later).

Customers who's restriction policy setting "Allow cross file copy and paste" is not working as expected after Citrix Endpoint Management CEM upgraded to 22.2.0 or later release...

CVE-2022-23907

CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting XSS vulnerability via the parameter m1fmmessage...

PT-2022-16585 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.2.4 Description: The issue arises from some example DAGs in Apache Airflow not properly sanitizing user-provided params, making them susceptible to OS Command Injection from the web UI. Recommendations: For...

PYSEC-2022-19

The % debug % template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS...

CVE-2021-46527

Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via mjsgetcstring at src/mjsstring.c...

CVE-2022-22109

In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting XSS vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they open the “/tasks” page to view all the...

Gila CMS Cross-Site Scripting Vulnerability (CNVD-2021-84281)

Gila CMS is an open source content management system CMS based on PHP and MySQL. A cross-site scripting vulnerability exists in Gila CMS version 2.2.0, which can be used by an attacker to steal cookies, passwords, or run arbitrary code on a victim's browser...

CVE-2021-39486

A Stored XSS via Malicious File Upload exists in Gila CMS version 2.2.0. An attacker can use this to steal cookies, passwords or to run arbitrary code on a victim's browser...

PT-2021-16151 · WordPress · Visual Link Preview

Name of the Vulnerable Software and Affected Versions: Visual Link Preview WordPress plugin versions prior to 2.2.3 Description: The issue allows any authenticated user to call several AJAX actions without proper authorization, due to the CSRF nonce being displayed for all authenticated users. Th...

PrusaSlicer 资源管理错误漏洞

PrusaSlicer is a 3D printing data processing software. A security vulnerability exists in PrusaSlicer 2.2.0 that originates from improper management of system resources e.g., memory, disk space, files, etc. by a networked system or product...

J2eeFAST SQL注入漏洞

J2eeFAST is a Java EE enterprise-class rapid development platform , is committed to building the best small and medium-sized open source free backend framework platform . J2eeFAST 2.2.1 suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL...

GHSA-7F92-RR6W-CQ64 Storage corruption due to variables overwritten by re-entrancy locks

Background When attempting to use the v0.2.14 release, @pandadefi discovered an issue using the @nonreentrant decorator. Impact Reentrancy protection storage slots get allocated to the same slots as storage variables, leading to the corruption of storage variables when using the @nonreentrant...

CVE-2021-37453

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via the extension name stored...

CVE-2021-37455

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan stored...

Missing permission check in requests allows sending emails

requests 2.2.7 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to send test emails to an attacker-specified email address. requests 2.2.8 requires Overall/Administer permission to send test emails...

SICK Visionary-S CX 加密问题漏洞

SICK Visionary-S CX is a 3D vision sensor from SICK, Germany. It provides direct output of color and depth values via Ethernet. The SICK Visionary-S CX has a security vulnerability in versions prior to 5.21.2.29154R, which can be exploited by an attacker with a weak password to more easily...

CVE-2021-27479

ZOLL Defibrillator Dashboard, v prior to 2.2,The affected product’s web application could allow a low privilege user to inject parameters to contain malicious scripts to be executed by higher privilege users...

Unspecified Vulnerability in JerryScript (CNVD-2021-42992)

JerryScript is a lightweight JavaScript engine . A security vulnerability exists in parseremitcbcbackwardbranch in /home/JerryScript/jerry-core/parser/js/js-parser-util.c in JerryScript version 2.2.0. No details of the vulnerability are provided at this time...

Unspecified vulnerability in JerryScript (CNVD-2021-42987)

JerryScript is a lightweight JavaScript engine . A security vulnerability exists in parserparsestatements in js-parser-statm.c:2756 in JerryScript version 2.2.0. No details of the vulnerability are provided at this time...