OESA-2022-1696 openjdk-11 security update

The OpenJDK runtime environment. Security Fixes: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and...

PT-2022-21028

Name of the Vulnerable Software and Affected Versions Badminton Center Management System version 1.0 Description The issue allows for SQL Injection via the /bcms/admin/?page=service transactions/view details endpoint, specifically through the id parameter. This could potentially lead to...

PT-2022-21012

Name of the Vulnerable Software and Affected Versions Online Fire Reporting System version 1.0 Description The issue allows for SQL Injection via the /ofrs/classes/Master.php?f=delete team API endpoint, specifically through the f parameter. This could potentially lead to unauthorized data access ...

PT-2022-20694

Name of the Vulnerable Software and Affected Versions Online Ordering System version 2.3.2 Description The issue allows for SQL Injection via the "/ordering/admin/category/index.php?view=edit&id=" API endpoint, specifically targeting the id variable. This could potentially lead to unauthorized da...

CVE-2022-1462

An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flushtoldisc function. This flaw allows a local user to crash the...

CSCMS Music Portal System SQL注入漏洞

CSCMS Music Portal System is a diversified content management system of China Chong Sheng Network Technology CSCMS Company. CSCMS Music Portal System suffers from a SQL injection vulnerability that originates from the lack of validation of the id parameter in /admin.php/singer/admin/singer/del fo...

CVE-2020-4926

A vulnerability in the Spectrum Scale 5.1 core component and IBM Elastic Storage System 6.1 could allow unauthorized access to user data or injection of arbitrary data in the communication protocol. IBM X-Force ID: 191600...

GHSA-F4W6-3RH6-6Q4Q Kubernetes CSI Sidecar Containers Can Allow Unauthorized Data Access

Improper input validation in Kubernetes CSI sidecar containers for external-provisioner v0.4.3, v1.0.2, v1.1, v1.2.2, v1.3.1, external-snapshotter v0.4.2, v1.0.2, v1.1, 1.2.2, and external-resizer v0.1, v0.2 could result in unauthorized PersistentVolume data access or volume mutation during...

GHSA-8PRC-58J4-M55Q Keycloak Unauthenticated Access

A flaw was found in the Keycloak REST API before version 8.0.0, implemented in Keycloak before 7.0.1 where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry...

CVE-2022-21500

Vulnerability in Oracle E-Business Suite component: Manage Proxies. The supported version that is affected is 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Suite. Successful attacks of this vulnerability can...

Cybozu Garoon Input Validation Error Vulnerability (CNVD-2022-54301)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. An input validation error vulnerability exists in Cybozu Garoon, which stems from insufficient user-supplied inpu...

Oracle Java SE Multiple Vulnerabilities (April 2022 CPU)

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is affected by multiple vulnerabilities as referenced in the April 2022 CPU advisory: - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Librarie...

Mercurial Incorrect Access Control vulnerability

Mercurial version 4.5 and earlier contains a Incorrect Access Control CWE-285 vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1...

GHSA-V5RQ-W2XM-7G5F Improper Access Control in MySQL Connector Python

Vulnerability in the MySQL Connectors component of Oracle MySQL subcomponent: Connector/Python. Supported versions that are affected are 8.0.13 and prior and 2.1.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Connector...

PT-2022-20083

Name of the Vulnerable Software and Affected Versions Sourcecodester Simple Social Networking Site version 1.0 Description The issue is related to SQL Injection, which can be exploited via the /sns/admin/?page=user/manage user&id= endpoint. The id parameter is vulnerable to injection attacks. Thi...

PT-2022-20106

Name of the Vulnerable Software and Affected Versions Covid-19 Travel Pass Management System version 1.0 Description The issue allows for SQL Injection via the "/ctpms/admin/?page=applications/view application&id=" API endpoint, specifically targeting the id variable. This could potentially lead ...

CVE-2022-20744: Reliance on Untrusted Inputs in a Security Decision

A vulnerability in the input protection mechanisms of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to view data without proper authorization. This vulnerability exists because of a protection mechanism that relies on the existence or values of a...

CVE-2022-1300

Multiple Version of TRUMPF TruTops products expose a service function without necessary authentication. Execution of this function may result in unauthorized access to change of data or disruption of the whole service...

Adobe Framemaker Buffer Overflow Unauthorized Access

The vulnerability of the Adobe Framemaker desktop publishing system relates to reading beyond the buffer in memory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current curl Multiple Vulnerabilities (SSA:2022-117-01)

The version of curl installed on the remote host is prior to 7.83.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-117-01 advisory. - A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data...