CVE-2022-41702

The affected product DIAEnergie versions prior to v1.9.01.002 is vulnerable to a stored cross-site scripting vulnerability through the InsertReg API...

PT-2022-21932 · Unknown · Wp All Export Pro

Name of the Vulnerable Software and Affected Versions: WP All Export Pro versions prior to 1.7.9 Description: The issue allows users with permission to run exports to execute arbitrary SQL statements due to the direct use of the cc sql POST parameter as a database query. This affects users who ha...

CVE-2016-20017

D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022...

CVE-2022-22218

On SRX Series devices, an Improper Check for Unusual or Exceptional Conditions when using Certificate Management Protocol Version 2 CMPv2 auto re-enrollment, allows a network-based, unauthenticated attacker to cause a Denial of Service DoS by crashing the pkid process. The pkid process cannot...

UBUNTU-CVE-2022-40664

Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher...

PT-2022-34773 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.12 Description: A percpu memory leak was discovered in the nf tables module at the nf tables addchain function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linu...

CVE-2022-40494

NPS before v0.26.10 was discovered to contain an authentication bypass vulnerability via constantly generating and sending the Auth key and Timestamp parameters...

UBUNTU-CVE-2022-42004

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer.deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization...

Design/Logic Flaw

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the stable branch and prior to 2.9.0.beta10 on the beta and tests-passed branches, a moderator can create new and edit existing themes by using the API when they should not be able to do so. The problem is patched in...

Zephyr 安全漏洞

Zephyr is Zephyr Project open source a scalable real-time operating system RTOS. A cross-site scripting vulnerability exists in Zephyr Project Manager versions prior to 3.2.5, which stems from a lack of effective filtering and escaping of user-supplied data in the onanimationstart parameter, and...

PT-2022-20036 · WordPress · Bitcoin / Altcoin Faucet Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Bitcoin / Altcoin Faucet WordPress plugin versions prior to 1.6.1 Description: The issue concerns a lack of CSRF check when saving settings, allowing an attacker to make a logged-in admin change them via a CSRF attack. Additionally, due to th...

Rdiffweb 跨站请求伪造漏洞

Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. It provides quick access to your archives through an efficient web interface. A cross-site request forgery vulnerability exists in Rdiffweb versions prior to 2.4.7. An attacker could exploit this vulnerability t...

PT-2022-21439 · Rdiffweb · Rdiffweb

Name of the Vulnerable Software and Affected Versions: rdiffweb versions prior to 2.4.7 Description: The issue is related to Cross-Site Request Forgery CSRF, which allows an attacker to change a user's email ID. Recommendations: For versions prior to 2.4.7, update to version 2.4.7 to resolve the...

Information disclosure

Versions of IBM Spectrum Protect Plus prior to 10.1.12 excluding 10.1.12 include the private key information for a certificate inside the generated .crt file when uploading a TLS certificate to IBM Spectrum Protect Plus. If this generated .crt file is shared, an attacker can obtain the private ke...

PT-2022-33407 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.4 Description: The issue is related to an out of range error in the aq vec index. It was introduced in version v4.11 and fixed in version v5.19.4. The actual impact and attack plausibility have not yet bee...

PT-2022-33666 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.65 Description: The issue is related to a lockdep splat with reloc root extent buffers in btrfs. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versio...

PT-2022-20724 · Drawio · Drawio

Name of the Vulnerable Software and Affected Versions: drawio versions prior to 20.3.0 Description: The issue is related to Cross-site Scripting XSS - Generic in the GitHub repository jgraph/drawio. Recommendations: For versions prior to 20.3.0, update to version 20.3.0 or later to resolve the...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.10)

The version of AOS installed on the remote host is prior to 5.10. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.10 advisory. - In the Linux kernel, a certain net/ipv4/tcpoutput.c change, which was properly incorporated into 4.16.12, was incorrectly...

WordPress plugin WP Hide & Security Enhancer 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Elastic Cloud Enterprise 日志信息泄露漏洞

Elastic Cloud Enterprise is a cloud platform from Elastic. It makes it easy to deploy, operate, and scale Elastic Stack in the cloud. A security vulnerability exists in ECE versions prior to 3.4.0, which stems from the disclosure of sensitive information about user passwords and Elasticsearch...