Apache Doris 信任管理问题漏洞

Apache Doris is a modern MPP analytics database product from the Apache Foundation, USA. An information disclosure vulnerability exists in versions of Apache Doris prior to 1.0.0, which stems from the use of hard-coded keys and IVs to initialize the cipher used for ldap passwords. An attacker cou...

CVE-2022-1459

Non-Privilege User Can View Patient’s Disclosures in GitHub repository openemr/openemr prior to 6.1.0.1...

UBUNTU-CVE-2022-1452

Out-of-bounds Read in rbinjavabootstrapmethodsattrnew function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a...

GHSA-4QQF-HMV6-R6WH Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J

The implementations of PKCS1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack...

OWASP AntiSamy 跨站脚本漏洞

OWASP AntiSamy is a library for HTML and CSS coding from the US-based Owasp Foundation. A security vulnerability exists in OWASP AntiSamy versions prior to 1.6.7, which arises from an output serializer that does not properly encode assumed Cascading Style Sheet CSS content...

CVE-2022-28327

The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input...

CVE-2022-21491

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.34. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

CVE-2022-21465

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.34. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromis...

CVE-2022-21409

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Web Runtime. The supported version that is affected is Prior to 9.2.6.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne...

UBUNTU-CVE-2022-21488

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.34. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

Kentico 安全漏洞

Kentico is the United States Kentico company's set of ASP.NET-based content management system CMS. A security vulnerability exists in Kentico CMS before 13.0.66, which can be exploited by an attacker with user administrative privileges administrator by default to export any user's user options,...

CVE-2022-1231

XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagram embedder. Depending on the actual context, this ranges from stealing secrets to account hijacking or even to code execution for example in desktop...

YottaDB 安全漏洞

YottaDB is a real-time database from YottaDB, Inc. A security vulnerability exists in YottaDB versions prior to r1.32 and V7.0-000, which could be exploited by an attacker to calculate the size of a call to memset in opfnj3 in srport/opfnj3.c, resulting in a very large value that could cause a...

pearweb 代码问题漏洞

pearweb is a PHP extension and application repository. A security vulnerability exists in pearweb before 1.32, which stems from deserialization of untrusted data...

YottaDB缓冲区错误漏洞

YottaDB is a real-time database from YottaDB, Inc. A security vulnerability exists in versions of YottaDB prior to r1.32, which could be exploited by attackers to control the size variables and buffers passed to memcpy calls to overwrite critical data structures and control the execution flow...

FIS GT.M 代码问题漏洞

FIS GT.M is a database platform. A security vulnerability exists in FIS GT.M versions prior to V7.0-000, which can be exploited by an attacker to cause a NULL pointer to be dereferenced after a call to ZPrint...

CVE-2021-43287

An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD server to unauthenticated attackers...

CVE-2022-1351

Stored XSS in Tooltip in GitHub repository pimcore/pimcore prior to 10.4...

CVE-2022-1279

A vulnerability in the encryption implementation of EBICS messages in the open source librairy ebics-java/ebics-java-client allows an attacker sniffing network traffic to decrypt EBICS payloads. This issue affects: ebics-java/ebics-java-client versions prior to 1.2...

CVE-2022-1333

Mattermost Playbooks plugin v1.24.0 and earlier fails to properly check the limit on the number of webhooks, which allows authenticated and authorized users to create a specifically drafted Playbook which could trigger a large amount of webhook requests leading to Denial of Service...