CVE-2022-42468

Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol...

PT-2022-27019 · Baramundi · Baramundi Management Suite

Name of the Vulnerable Software and Affected Versions: baramundi Management Suite versions 2021 R1 through 2022 R1 Description: The issue allows remote code execution. It is estimated that a significant number of devices worldwide could be affected, although the exact number is not specified. The...

Joomla! 跨站脚本漏洞

Joomla! is a set of forum components used in the Joomla! content management system. A security vulnerability exists in Joomla! versions 4.0.0 through 4.2.3 that stems from insufficient filtering of user input...

Gradle 安全漏洞

Gradle is a set of JVM-based project building tools from Gradle, Inc. that supports maven, Ivy repositories, and more. A security vulnerability exists in Gradle Enterprise versions 2022.3 through 2022.3.3. A remote attacker can access application data by exploiting the vulnerability...

@agoric/access-token (>=0.4.16-dev-23c942c.0, <=0.4.16-dev.0), @agoric/assert (>=0.1.0, <=0.3.15-dev.2) +100 more potentially affected by unknown CVE via ses (>=0.0.1, <=0.15.24)

ses NPM version =0.0.1, =0.4.16-dev-23c942c.0, =0.1.0, =1.2.0, =1.3.0, =0.1.0, =0.10.8-dev.0, =0.2.0, =1.5.1, =0.5.6-dev-f662032.0, =0.0.1, =0.1.1, =0.0.9, =0.1.1, =0.2.0, =0.5.30-dev-fe997f2.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WHPX-Q3RQ-W8JC...

nopCommerce 输入验证错误漏洞

nopCommerce is an open source general purpose e-commerce platform. A security vulnerability exists in nopCommerce versions 4.10 to 4.50.1, which is caused by an open redirection in the ChangePassword function, SignInCustomerAsync function, SuccessAuthentication method, and NopRedirectResultExecut...

GHSA-5QWQ-G2HX-R6F7 Hessian Lite for Apache Dubbo deserialization vulnerability

A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version...

PT-2022-24829 · Tuleap +1 · Tuleap +1

Name of the Vulnerable Software and Affected Versions: Tuleap versions 12.9.99.228 through 14.0.99.23 Description: The issue concerns improper verification of authorizations when updating the branch prefix used by the GitLab repository integration. Authenticated users can change the branch prefix...

FortiTester 操作系统命令注入漏洞

FortiTester is a Fortinet professional-based network traffic testing tool from FortiTester, Inc. A security vulnerability exists in FortiTester versions 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, and 7.0.0 through 7.1.0, which stems from improper invalidation of special elements used in OS command...

Liferay Portal 跨站脚本漏洞

Liferay Portal is a J2EE-based portal solution from Liferay, Inc. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network and more. A security vulnerability exists in Liferay Portal...

PT-2022-5187 · Ibm · Ibm Cognos Analytics

Name of the Vulnerable Software and Affected Versions: IBM Cognos Analytics versions 11.1.7 through 11.2.1 Description: The issue is related to the transmission of critical information in plain text. Exploitation of this issue may allow a remote attacker to disclose protected information. It is...

GitLab 路径遍历漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A path traversal vulnerability exists in GitLab CE/EE versions 12.7 through...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A security vulnerability exists in GitLab CE/EE versions 10.0 to 15.2.5, 15.3 t...

PT-2022-34626 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v3.18 through v5.15.67 Description: The issue concerns absolute zero lowcore corruption on boot. It was introduced in version v3.18 and fixed in version v5.15.68. The actual impact and attack plausibility have not yet be...

PT-2023-6741 · Ibm +3 · Jsse +5

Name of the Vulnerable Software and Affected Versions: IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE versions 8.0.7.0 through 8.0.7.11 Description: The issue is related to the use of flawed cryptographic algorithms in the Java Secure Socket Extension JSSE and IBMJCEPlus...

Hyperledger Besu 安全漏洞

Hyperledger Besu is an open source application from Hyperledger. It is used to run, maintain, debug and monitor nodes in the Ethernet network. A security vulnerability exists in Hyperledger Besu versions prior to 22.1.3 through 22.7.1, which stems from an error in its 32-bit signed and unsigned...

Parse Server 安全漏洞

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A security vulnerability exists in Parse Server versions prior to 4.10.15, 5.0.0 through 5.2.6. An attacker can use this vulnerability to assign a session object to his or her own user by writi...

PYSEC-2022-280

In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's /confirm endpoint...

Cloudreve 跨站脚本漏洞

Cloudreve is Cloudreve open source a public cloud file system that supports multiple cloud storage drives. A cross-site scripting vulnerability exists in Cloudreve versions v1.0.0 through v3.5.3. The vulnerability stems from the discovery of a cross-site scripting XSS vulnerability via the file...

CVE-2022-25873

The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting XSS due to improper input sanitization in the 'eventName' function within the VCalendar component...