AZL-33608 CVE-2022-32149 affecting package libcontainers-common for versions less than 20210626-6

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse...

CVE-2022-36803

The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permission to use the MasterUserEdit API to modify any users role to Super Admin. This vulnerability was reported by Jacob Shafer from Bishop Fox...

Internet Initiative Japan SmartKey 安全漏洞

Internet Initiative Japan SmartKey IIJ SmartKey is an authentication application from Internet Initiative Japan. A security vulnerability exists in Internet Initiative Japan SmartKey versions prior to 2.1.4, which stems from an attacker's ability to obtain one-time passwords sent by it...

AZL-26161 CVE-2022-37601 affecting package reaper for versions less than 3.1.1-3

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3...

DEBIAN-CVE-2022-40664

Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher...

CVE-2022-41404

An issue in the fetch method in the BasicProfile class of org.ini4j through version v0.5.4 allows attackers to cause a Denial of Service DoS via unspecified vectors...

CVE-2022-37616

A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom published as @xmldom/xmldom package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the positio...

SAP 3D Visual Enterprise Viewer 缓冲区错误漏洞

SAP 3D Visual Enterprise Viewer is a 3D view viewer from SAP, Germany. The software supports the publishing of 2D and 3D scenes in all industry-standard desktop applications and supports separate installation as a stand-alone executable program and ActiveX space. A buffer overflow vulnerability...

SAP 3D Visual Enterprise Viewer 缓冲区错误漏洞

SAP 3D Visual Enterprise Viewer is a 3D view viewer from SAP, Germany. The software supports the publishing of 2D and 3D scenes in all industry-standard desktop applications and supports separate installation as a stand-alone executable program and ActiveX space. A buffer overflow vulnerability...

SAP 3D Visual Enterprise Viewer 缓冲区错误漏洞

SAP 3D Visual Enterprise Viewer is a 3D view viewer from SAP, Germany. The software supports the publishing of 2D and 3D scenes in all industry-standard desktop applications and supports separate installation as a stand-alone executable program and ActiveX space. A buffer overflow vulnerability...

PYSEC-2022-43158

Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.0a4...

VINCE 跨站脚本漏洞

VINCE is a CERT Coordination Center in the United States CERT Coordination Center open source a CERT Coordination Center development and use of vulnerability information and coordination environment. Vulnerability disclosure for improved coordination. A cross-site scripting vulnerability exists i...

CVE-2022-3276

Command injection is possible in the puppetlabs-mysql module prior to version 13.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise...

PYSEC-2022-42983

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API...

tiny-csrf 安全漏洞

tiny-csrf is a small csrf library by Vincent Alexander Saulys personal developer. It is intended to replace the work done by csurf before it was removed. A security vulnerability exists in versions of tiny-csrf prior to 1.1.0, which stems from the fact that cookies are not encrypted, and thus CSR...

D-BUS 数据伪造问题漏洞

D-BUS is a message bus system, which is mainly used for inter-process communication and remote procedure calls. A security vulnerability exists in D-BUS versions prior to 1.12.24-0+deb11u1, which stems from the inclusion of multiple vulnerabilities in D-Bus that can be exploited by an attacker to...

PT-2022-21443 · Puppet +1 · Puppetlabs-Apt +1

Name of the Vulnerable Software and Affected Versions: puppetlabs-apt versions prior to 9.0.0 Description: Command injection is possible in the puppetlabs-apt module. A malicious actor can exploit this issue if they can provide unsanitized input to the module. This condition is rare in most...

Dell Hybrid Client 路径遍历漏洞

Dell Hybrid Client is a software application from Dell USA Inc. It provides a client computing software with hybrid cloud management capabilities. A path traversal vulnerability exists in Dell Hybrid Client versions prior to 1.8. The vulnerability stems from a failure of a networked system or...

Heimavista Rpage 跨站脚本漏洞

Heimavista Rpage is a content management system from the Chinese company Heimavista. A cross-site scripting vulnerability exists in versions of Heimavista Rpage prior to v5.4.103, which stems from insufficient filtering of the platform's web URLs that allows an unauthenticated, remote attacker to...

CVE-2022-35257

A local privilege escalation vulnerability in UI Desktop for Windows Version 0.55.1.2 and earlier allows a malicious actor with local access to a Windows device with UI Desktop to run arbitrary commands as SYSTEM...