GHSA-4QQF-HMV6-R6WH Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J

The implementations of PKCS1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack...

OWASP AntiSamy 跨站脚本漏洞

OWASP AntiSamy is a library for HTML and CSS coding from the US-based Owasp Foundation. A security vulnerability exists in OWASP AntiSamy versions prior to 1.6.7, which arises from an output serializer that does not properly encode assumed Cascading Style Sheet CSS content...

CVE-2022-28327

The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input...

CVE-2022-21491

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.34. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

CVE-2022-21465

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.34. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromis...

CVE-2022-21409

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Web Runtime. The supported version that is affected is Prior to 9.2.6.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne...

UBUNTU-CVE-2022-21488

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.34. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

Kentico 安全漏洞

Kentico is the United States Kentico company's set of ASP.NET-based content management system CMS. A security vulnerability exists in Kentico CMS before 13.0.66, which can be exploited by an attacker with user administrative privileges administrator by default to export any user's user options,...

CVE-2022-1231

XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagram embedder. Depending on the actual context, this ranges from stealing secrets to account hijacking or even to code execution for example in desktop...

YottaDB 安全漏洞

YottaDB is a real-time database from YottaDB, Inc. A security vulnerability exists in YottaDB versions prior to r1.32 and V7.0-000, which could be exploited by an attacker to calculate the size of a call to memset in opfnj3 in srport/opfnj3.c, resulting in a very large value that could cause a...

pearweb 代码问题漏洞

pearweb is a PHP extension and application repository. A security vulnerability exists in pearweb before 1.32, which stems from deserialization of untrusted data...

FIS GT.M 代码问题漏洞

FIS GT.M is a database platform. A security vulnerability exists in FIS GT.M versions prior to V7.0-000, which can be exploited by an attacker to cause a NULL pointer to be dereferenced after a call to ZPrint...

YottaDB缓冲区错误漏洞

YottaDB is a real-time database from YottaDB, Inc. A security vulnerability exists in versions of YottaDB prior to r1.32, which could be exploited by attackers to control the size variables and buffers passed to memcpy calls to overwrite critical data structures and control the execution flow...

CVE-2021-43287

An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD server to unauthenticated attackers...

CVE-2022-1351

Stored XSS in Tooltip in GitHub repository pimcore/pimcore prior to 10.4...

CVE-2022-1279

A vulnerability in the encryption implementation of EBICS messages in the open source librairy ebics-java/ebics-java-client allows an attacker sniffing network traffic to decrypt EBICS payloads. This issue affects: ebics-java/ebics-java-client versions prior to 1.2...

CVE-2022-1333

Mattermost Playbooks plugin v1.24.0 and earlier fails to properly check the limit on the number of webhooks, which allows authenticated and authorized users to create a specifically drafted Playbook which could trigger a large amount of webhook requests leading to Denial of Service...

CVE-2022-28661

A vulnerability has been identified in Simcenter Femap All versions V2022.1.2. The affected application contains an out of bounds read past the end of an allocated buffer while parsing specially crafted .NEU files. This could allow an attacker to execute code in the context of the current process...

CVE-2022-1007

The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue...

PT-2022-18627 · Unknown · Factorycamera

Name of the Vulnerable Software and Affected Versions: FactoryCamera versions prior to 2.1.96 Description: The issue is related to improper access control in FactoryCamera, allowing an attacker to access a file with system privilege. Recommendations: For versions prior to 2.1.96, update to versio...