ThinkPHP SQLi Vulnerability

ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the aggregate variable. NOTE: a backquote character is required in the attack URI...

Unauthenticated File Read in PHP Proxy

In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2018-19246...

[SECURITY] Fedora 35 Update: libxml2-2.9.14-1.fc35

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

GHSA-5JXP-4X68-MHQC Centreon SQL Injection

Centreon 3.4.x fixed in Centreon 18.10.0 and Centreon web 2.8.24 allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI...

CentOS: Security Advisory for java (CESA-2022:1487)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

GHSA-J7FX-V37J-V3W7 Craft CMS Vulnerable to Server-Side Template Injection

Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a % string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext userna...

Stored XSS in LavaLite 5.5

LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit...

GHSA-PXXP-283V-XPQ5 Stored XSS in LavaLite 5.5

LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit...

GHSA-7M2W-9GW7-C3XP open-uri-cached Gem for Ruby Unsafe Temporary File Creation Enables Code Execution

The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing "openuri-" followed by a crafted UID, and putting Ruby code in said directory once a metafile is created...

open-uri-cached Gem for Ruby Unsafe Temporary File Creation Enables Code Execution

The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing "openuri-" followed by a crafted UID, and putting Ruby code in said directory once a metafile is created...

GHSA-RXVX-44W5-44R7 Improper Neutralization of Input During Web Page Generation in Apache Sling

Multiple cross-site scripting XSS vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to 1 org/apache/sling/api/servlets/HtmlResponse and 2...

Cisco TelePresence Collaboration Endpoint RoomOS Information Disclosure

The vulnerability of the Microprogramming Software of the Cisco TelePresence Collaboration Endpoint CE device and the Cisco RoomOS operating system is related to the lack of measures taken to neutralize encrypted URI schemes on web pages. Exploiting this vulnerability can allow a malicious actor ...

MingSoft MCMS SQL Injection Vulnerability (CNVD-2022-72199)

MingSoft MCMS is a J2ee system from MingSoft, a Chinese company. SQL injection vulnerability exists in Mingsoft MCMS version 5.2.7, which can be exploited by attackers to conduct SQL injection attacks in the /mdiy/dict/list URI via the orderBy parameter...

MingSoft MCMS SQL Injection Vulnerability (CNVD-2022-72200)

MingSoft MCMS is a J2ee system from MingSoft, a Chinese company. version 5.2.7 of Mingsoft MCMS is vulnerable to SQL injection, which can be exploited by attackers to conduct SQL injection attacks in /mdiy/dict/listExcludeApp URI via the orderBy parameter...

CentOS 7 : java-11-openjdk (RHSA-2022:1440)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1440 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. Supported versions that are affecte...

CVE-2022-30525 (FIXED): Zyxel Firewall Unauthenticated Remote Command Injection

Rapid7 discovered and reported a vulnerability that affects Zyxel firewalls supporting Zero Touch Provisioning ZTP, which includes the ATP series, VPN series, and the USG FLEX series including USG20-VPN and USG20W-VPN. The vulnerability, identified as CVE-2022-30525, allows an unauthenticated and...

curl: error parse uri path in curl

Summary: add summary of the vulnerability The uri path error could lead to security filter bypasses. For example, we can use curl -vv 'fh-jle:///etc/passwd' to bypass file protocol black list we can use curl -vv 'http://1.1.1.1:80-9000' to scan the open port in the host etc ... Steps To Reproduce...

Sql injection

Mingsoft MCMS 5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/list URI via orderBy parameter...

CVE-2022-30048

CVE-2022-30048 affects Mingsoft MCMS 5.2.7 and is a SQL injection vulnerability in the /mdiy/dict/list endpoint exploited through the orderBy parameter. Root cause: unvalidated input leading to SQL injection; impact includes potential data exposure or modification as indicated by CVSS metrics (CV...

CVE-2022-30047

MingSoft MCMS version 5.2.7 is vulnerable to a SQL injection vulnerability. An attacker can exploit this flaw in the /mdiy/dict/listExcludeApp URI by providing malicious input through the orderBy parameter. This is a J2ee system where the lack of proper neutralization of special elements in SQL c...