4651 matches found
ALPINE-CVE-2022-1348
A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the state file does not exist, it is created with world-readable permission, allowing an...
GHSA-5V8V-66V8-MWM7 Integer overflow in the bundled Brotli C library
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli...
GHSA-G24C-FX4V-XG9W Mattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service provider
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled...
Mattermost Server exposes information stored by a web browser
An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser...
GHSA-J26G-95PH-2MWV Mattermost Server: Insufficient Password-Reset Link Invalidation
An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused...
Mattermost Server is vulnerable to Uncontrolled Resource Consumption
An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang...
Mattermost Server is vulnerable to XSS via a Legal or Support setting
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting...
Mattermost Server vulnerable to Cross-site Scripting through file preview feature
An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview...
CVE-2022-1811
Unrestricted Upload of File with Dangerous Type in GitHub repository publify/publify prior to 9.2.9...
CVE-2022-1752
Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.2...
mailcow 操作系统命令注入漏洞
mailcow is a mail server suite. A security vulnerability exists in versions prior to mailcow 2022-05d, which can be exploited by a remote, authenticated attacker to inject operating system commands and elevate privileges to domain administrator...
PT-2022-19623 · WordPress · Opal Hotel Room Booking
Name of the Vulnerable Software and Affected Versions: Opal Hotel Room Booking plugin versions prior to 1.2.8 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with contributor or higher user role can inject malicious...
Zoom Client 信息泄露漏洞
Zoom Client is a video conferencing client application from Zoom, Inc. that supports multiple platforms. An information disclosure vulnerability exists in Zoom Client for Meetings prior to version 5.10.0, which stems from an inability to properly bind a client session cookie to a Zoom domain...
Erudika Para 跨站脚本漏洞
Erudika Para is a command-line interface from the Bulgarian company Erudika. cross-site scripting vulnerability exists in versions prior to Erudika Para v1.45.11, which stems from a function in Utils.java that lacks filtering and escaping for user data. An attacker could use this vulnerability to...
CVE-2022-28617
A remote bypass security restrictions vulnerability was discovered in HPE OneView versions: Prior to 7.0. HPE has provided a software update to resolve this vulnerability in HPE OneView...
CVE-2022-22784
The Zoom Client for Meetings for Android, iOS, Linux, MacOS, and Windows before version 5.10.0 failed to properly parse XML stanzas in XMPP messages. This can allow a malicious user to break out of the current XMPP message context and create a new message context to have the receiving users clien...
FlyteConsole 代码问题漏洞
FlyteConsole is a console component for Flyte. A code issue vulnerability exists in FlyteConsole versions prior to 0.52.0 that stems from vulnerability to server-side request forgery SSRF attacks. An attacker can exploit any user of a vulnerable instance to access an internal metadata server or...
CVE-2022-30781
Gitea before 1.16.7 does not escape git fetch remote...
GHSA-Q9HR-3PG4-3JP4 Improper Input Validation in Apache ActiveMQ
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service JMS ObjectMessage object...