JetBrains Ktor framework 授权问题漏洞

JetBrains Ktor framework is a web application framework from the Czech company JetBrains. A security vulnerability exists in JetBrains Ktor framework versions prior to 2.1.0, which stems from the possibility that a user may select the wrong authentication under certain circumstances...

WordPress plugin weForms 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

muhttpd 路径遍历漏洞

muhttpd is a simple but complete web server for inglorion individual developers. Written in portable ANSI C, it supports logging, CGI scripting, MIME type based handlers and HTTPS. A security vulnerability exists in muhttpd versions prior to 1.1.7. An attacker could exploit this vulnerability to...

Grommunio Gromox 安全漏洞

Grommunio Gromox is a groupware server from Grommunio that replaces Microsoft Exchange. A security vulnerability exists in Grommunio Gromox versions prior to 1.28, which stems from weak permissions in the configuration file in the PAM module, and can be exploited by an attacker to allow the PAM...

CVE-2022-37396

In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution...

CVE-2022-27619

Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Client before 2.2.2-609 allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors...

CVE-2022-1950

The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection...

CVE-2022-2181

The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting...

WordPress plugin Youzify SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogging sites on PHP and MySQL servers. A SQL injection vulnerability exists in the...

Rust-WebSocket 资源管理错误漏洞

Rust-WebSocket is a Rust-based WebSocket library. A resource management error vulnerability exists in Rust-WebSocket versions prior to 0.26.5, which stems from the fact that an untrusted websocket connection may cause an out-of-memory OOM process to abort on the client or server. The root cause o...

Atlantis 安全漏洞

Atlantis is Atlantis open source a self-hosted golang application . It listens to Terraform pull request events via webhook. A security vulnerability exists in Atlantis versions prior to 0.19.7, which stems from a Timing Attack vulnerability in the package...

DEBIAN-CVE-2022-2008

Double free in WebGL in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Zulip 安全漏洞

Zulip is a powerful open source group chat application from the Zulip team. It is used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations. A security vulnerability exists in versions prior to Zulip 1.3.12, which stems from the fact that other users...

DEBIAN-CVE-2022-1861

Use after free in Sharing in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to enage in specific user interactions to potentially exploit heap corruption via specific user interaction...

CVE-2022-36911

A cross-site request forgery CSRF vulnerability in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers to connect to an attacker-specified URL...

CVE-2022-2549

NULL Pointer Dereference in GitHub repository gpac/gpac prior to v2.1.0-DEV...

hestiacp 操作系统命令注入漏洞

hestiacp is a lightweight and powerful control panel for the modern web. An operating system command injection vulnerability exists in hestiacp versions prior to 1.6.5, which stems from the ability to inject arbitrary commands when installing DokuWiki...

CVE-2022-1493

Use after free in Dev Tools in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific and direct user interaction...

CVE-2022-1307

Inappropriate implementation in full screen in Google Chrome on Android prior to 100.0.4896.88 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

CVE-2022-2189

The WP Video Lightbox WordPress plugin before 1.9.5 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...