4633 matches found
mruby 代码问题漏洞
mruby is a lightweight implementation of the Ruby language. A code issue vulnerability exists in versions prior to mruby 3.2 that can cause the mruby interpreter to crash, which can affect system availability...
CVE-2022-1098
Delta Electronics DIAEnergie all versions prior to 1.8.02.004 are vulnerable to a DLL hijacking condition. When combined with the Incorrect Default Permissions vulnerability of 4.2.2 above, this makes it possible for an attacker to escalate privileges...
CVE-2021-32957
A function in MDT AutoSave versions prior to v6.02.06 is used to retrieve system information for a specific process, and this information collection executes multiple commands and summarizes the information into an XML. This function and subsequent process gives full path to the executable and is...
CVE-2022-21235
The package github.com/masterminds/vcs before 1.13.3 are vulnerable to Command Injection via argument injection. When hg is executed, argument strings are passed to hg in a way that additional flags can be set. The additional flags can be used to perform a command injection...
PT-2022-13122 · Vditor · Vditor
Name of the Vulnerable Software and Affected Versions: vditor versions prior to 3.8.13 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input and later displays it without proper validation, allowing attackers to inject malicious...
OpenEMR 安全漏洞
OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. An insecure direct object reference vulnerability exists in OpenEMR versions prior...
CVE-2022-1106
use after free in mrbvmexec in GitHub repository mruby/mruby prior to 3.2...
PT-2022-16877 · Statamic · Statamic
Name of the Vulnerable Software and Affected Versions: Statamic versions prior to 3.2.39 Statamic versions prior to 3.3.2 Description: The issue allows an attacker to confirm a single character of a user's password hash using a specially crafted regular expression filter in the "users" endpoint o...
Nozomi Networks Guardian 输入验证错误漏洞
Nozomi Networks Guardian is an IoT device and software inspection system from Nozomi Networks, Switzerland. An input validation error vulnerability exists in versions of Nozomi Networks Guardian prior to 22.0.0, which can be exploited by an authenticated attacker with the role of Administrator or...
forkcms 跨站脚本漏洞
forkcms is a software application. A CMS. A security vulnerability exists in forkcms prior to 5.11.1. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor's announcement...
CVE-2022-25269
Passwork On-Premise Edition before 4.6.13 has multiple XSS issues...
CVE-2022-1030
Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An attacker, who has knowledge of a valid team name for the victim and also knows a valid target host where the user has access, can execute...
CVE-2021-4180
An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the wwwauthenticateuri parameter which is visible to all end users in configuration files. This would give sensitive...
CVE-2022-27228
In the vote aka "Polls, Votes" module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code...
Bitrix Site Manager 输入验证错误漏洞
Bitrix Site Manager is a web site management system from Bitrix USA. A security vulnerability exists in Bitrix Site Manager prior to version 21.0.100. An unauthenticated attacker could remotely execute arbitrary code...
ungit 参数注入漏洞
ungit is a simple way to use git by Fredrik Noren, a Swedish personal developer. A parameter injection vulnerability exists in ungit before 1.5.20, which can be exploited by an attacker to conduct a Remote Code Execution RCE attack...
PT-2022-12474 · Pascom +2 · Pascom Cloud Phone System +2
Name of the Vulnerable Software and Affected Versions: Pascom Cloud Phone System versions prior to 7.20.x Description: A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints. Recommendations: For versions prior...
PT-2022-16769
Name of the Vulnerable Software and Affected Versions Open Web Analytics versions prior to 1.7.4 Description The issue allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files...