PT-2022-13122 · Vditor · Vditor

Name of the Vulnerable Software and Affected Versions: vditor versions prior to 3.8.13 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input and later displays it without proper validation, allowing attackers to inject malicious...

OpenEMR 安全漏洞

OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. An insecure direct object reference vulnerability exists in OpenEMR versions prior...

CVE-2022-1106

use after free in mrbvmexec in GitHub repository mruby/mruby prior to 3.2...

PT-2022-16877 · Statamic · Statamic

Name of the Vulnerable Software and Affected Versions: Statamic versions prior to 3.2.39 Statamic versions prior to 3.3.2 Description: The issue allows an attacker to confirm a single character of a user's password hash using a specially crafted regular expression filter in the "users" endpoint o...

Nozomi Networks Guardian 输入验证错误漏洞

Nozomi Networks Guardian is an IoT device and software inspection system from Nozomi Networks, Switzerland. An input validation error vulnerability exists in versions of Nozomi Networks Guardian prior to 22.0.0, which can be exploited by an authenticated attacker with the role of Administrator or...

forkcms 跨站脚本漏洞

forkcms is a software application. A CMS. A security vulnerability exists in forkcms prior to 5.11.1. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor's announcement...

CVE-2022-25269

Passwork On-Premise Edition before 4.6.13 has multiple XSS issues...

CVE-2022-1030

Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An attacker, who has knowledge of a valid team name for the victim and also knows a valid target host where the user has access, can execute...

CVE-2021-4180

An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the wwwauthenticateuri parameter which is visible to all end users in configuration files. This would give sensitive...

CVE-2022-27228

In the vote aka "Polls, Votes" module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code...

Bitrix Site Manager 输入验证错误漏洞

Bitrix Site Manager is a web site management system from Bitrix USA. A security vulnerability exists in Bitrix Site Manager prior to version 21.0.100. An unauthenticated attacker could remotely execute arbitrary code...

ungit 参数注入漏洞

ungit is a simple way to use git by Fredrik Noren, a Swedish personal developer. A parameter injection vulnerability exists in ungit before 1.5.20, which can be exploited by an attacker to conduct a Remote Code Execution RCE attack...

PT-2022-12474 · Pascom +2 · Pascom Cloud Phone System +2

Name of the Vulnerable Software and Affected Versions: Pascom Cloud Phone System versions prior to 7.20.x Description: A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints. Recommendations: For versions prior...

PT-2022-16769

Name of the Vulnerable Software and Affected Versions Open Web Analytics versions prior to 1.7.4 Description The issue allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files...

CVE-2021-43956

The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototype pollution vulnerability...

CVE-2021-29134

The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL...

showdoc 跨站脚本漏洞

showdoc is open source and a great tool for IT teams to share documents online. showdoc versions prior to 2.10.4 have a security vulnerability that stems from the application allowing the upload of .ofd files, which leads to a cross-site scripting vulnerability. No detailed vulnerability details...

showdoc 跨站脚本漏洞

showdoc is an open source tool ideal for IT teams to share documents online. showdoc versions prior to v2.10.4 contain a file upload vulnerability that stems from the lack of effective detection of .xsl file extensions in the application's file upload feature. An attacker could exploit this...

CVE-2021-45886

An issue was discovered in PONTON X/P Messenger before 3.11.2. Anti-CSRF tokens are globally valid, making the web application vulnerable to a weakened version of CSRF, where an arbitrary token of a low-privileged user such as operator can be used to confirm actions of higher-privileged ones such...

Liblouis 安全漏洞

Liblouis is an open-source Braille translator written in C. It is a very easy to use and easy to use. A security vulnerability exists in Liblouis before 3.21.0. The vulnerability stems from a buffer overflow in compileTranslationTable.c in compilePassOpcode...