CVE-2021-43154

Cross Site Scripting XSS vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php...

FreeLAN 代码问题漏洞

FreeLAN is a free, open source, multi-platform, peer-to-peer VPN software from Julien Kauffmann, an individual developer in Canada. A security vulnerability exists in FreeLAN 2.2, which stems from an unreferenced service path vulnerability through a carefully crafted file in the FreeLAN service...

PT-2022-10169 · Moxa · Moxa Nport Iaw5000A-I/O

Name of the Vulnerable Software and Affected Versions: Moxa NPort IAW5000A-I/O series firmware versions 2.2 or earlier Description: The issue is related to improper input validation in the built-in web server, which may allow a remote attacker to execute commands. Recommendations: For Moxa NPort...

Android Enterprise: Allow cross file copy and paste policy not working as expected after Citrix Endpoint Management upgraded to 22.2.0 (or later).

Customers who's restriction policy setting "Allow cross file copy and paste" is not working as expected after Citrix Endpoint Management CEM upgraded to 22.2.0 or later release...

CVE-2022-23907

CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting XSS vulnerability via the parameter m1fmmessage...

PT-2022-16585 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.2.4 Description: The issue arises from some example DAGs in Apache Airflow not properly sanitizing user-provided params, making them susceptible to OS Command Injection from the web UI. Recommendations: For...

CVE-2021-3813

Improper Privilege Management in GitHub repository chatwoot/chatwoot prior to v2.2...

PYSEC-2022-19

The % debug % template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS...

CVE-2021-46527

Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via mjsgetcstring at src/mjsstring.c...

CVE-2022-22109

In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting XSS vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they open the “/tasks” page to view all the...

Gila CMS Cross-Site Scripting Vulnerability (CNVD-2021-84281)

Gila CMS is an open source content management system CMS based on PHP and MySQL. A cross-site scripting vulnerability exists in Gila CMS version 2.2.0, which can be used by an attacker to steal cookies, passwords, or run arbitrary code on a victim's browser...

CVE-2021-39486

A Stored XSS via Malicious File Upload exists in Gila CMS version 2.2.0. An attacker can use this to steal cookies, passwords or to run arbitrary code on a victim's browser...

PT-2021-16151 · WordPress · Visual Link Preview

Name of the Vulnerable Software and Affected Versions: Visual Link Preview WordPress plugin versions prior to 2.2.3 Description: The issue allows any authenticated user to call several AJAX actions without proper authorization, due to the CSRF nonce being displayed for all authenticated users. Th...

PrusaSlicer 资源管理错误漏洞

PrusaSlicer is a 3D printing data processing software. A security vulnerability exists in PrusaSlicer 2.2.0 that originates from improper management of system resources e.g., memory, disk space, files, etc. by a networked system or product...

J2eeFAST SQL注入漏洞

J2eeFAST is a Java EE enterprise-class rapid development platform , is committed to building the best small and medium-sized open source free backend framework platform . J2eeFAST 2.2.1 suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL...

GHSA-7F92-RR6W-CQ64 Storage corruption due to variables overwritten by re-entrancy locks

Background When attempting to use the v0.2.14 release, @pandadefi discovered an issue using the @nonreentrant decorator. Impact Reentrancy protection storage slots get allocated to the same slots as storage variables, leading to the corruption of storage variables when using the @nonreentrant...

CVE-2021-37455

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan stored...

CVE-2021-37453

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via the extension name stored...

Missing permission check in requests allows sending emails

requests 2.2.7 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to send test emails to an attacker-specified email address. requests 2.2.8 requires Overall/Administer permission to send test emails...

SICK Visionary-S CX 加密问题漏洞

SICK Visionary-S CX is a 3D vision sensor from SICK, Germany. It provides direct output of color and depth values via Ethernet. The SICK Visionary-S CX has a security vulnerability in versions prior to 5.21.2.29154R, which can be exploited by an attacker with a weak password to more easily...