多款Keysight Technologies产品代码问题漏洞

Keysight Technologies N6854A Geolocation server and Keysight Technologies N6841A RF Sensor are both products of Keysight Technologies, Inc.Keysight Technologies Keysight Technologies N6854A Geolocation server is a geolocation server.Keysight Technologies N6841A RF Sensor is an RF sensor. It is us...

MinDoc 代码问题漏洞

MinDoc is a Go-based online document management system based on the beego framework developed by Iminho Personal Developer. A security vulnerability exists in MinDoc v2.1-beta.5, which stems from an arbitrary file upload issue. The vulnerability can be exploited to execute arbitrary commands via ...

CVE-2022-1883

SQL Injection in GitHub repository camptocamp/terraboard prior to 2.2.0...

PT-2022-19580 · Apache · Apache Archiva

Name of the Vulnerable Software and Affected Versions: Apache Archiva versions prior to 2.2.8 Description: The issue allows any registered user to reset the password for any other user. Recommendations: For versions prior to 2.2.8, update to version 2.2.8 to resolve the issue...

HashiCorp go-getter 输入验证错误漏洞

HashiCorp go-getter is a library for HashiCorp's Go golang for downloading files or directories from various sources using URLs as the primary form of input. An input validation error vulnerability exists in HashiCorp go-getter version 2.0.2 and prior versions, which stems from the inability to...

PT-2022-4834

Name of the Vulnerable Software and Affected Versions dpkg versions prior to 1.21.8 dpkg versions prior to 1.20.10 dpkg versions prior to 1.19.8 dpkg versions prior to 1.18.26 Description The issue is related to a directory traversal vulnerability in the Dpkg::Source::Archive component of the...

Magento stored cross-site scripting vulnerability in the customer address upload feature

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by a stored cross-site scripting vulnerability in the customer address upload feature that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious...

Denial of Service (DoS)

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Denial of Service DoS due to the way the Kestrel...

Denial of Service (DoS)

Overview Microsoft.AspNetCore.App.Runtime.win-x86 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Denial of Service DoS due to the way the Kestrel web...

Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution

An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window...

GHSA-VW57-55F8-C73Q Mattermost Server allows XSS via CSRF

An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF...

GHSA-PM48-CVV2-29Q5 Ansible Uses Plugins That Disclose Credentials

Ansible, all ansibleengine-2.x versions and ansibleengine-3.x up to ansibleengine-3.5, was logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed i...

CVE-2022-29309

mysiteforme v2.2.1 was discovered to contain a Server-Side Request Forgery...

CVE-2022-0346

The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thus causing XSS via error message or RCE if allowurlinclude is turned on...

UBUNTU-CVE-2022-29190

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infinite loop when processing. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available...

Rakuten Mobile Rakuten Casa 安全漏洞

Rakuten Mobile Rakuten Casa is a small base station from Rakuten Mobile Japan, Inc. It is used to improve radio wave conditions for users.An access control error vulnerability exists in Rakuten Mobile Rakuten Casa APFV200 version and APFV141 version, which stems from improper access restrictions....

CVE-2022-29445

Authenticated administrator or higher role Local File Inclusion LFI vulnerability in Wow-Company's Popup Box plugin = 2.1.2 at WordPress...

DEBIAN-CVE-2022-1795

Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV...

DEBIAN-CVE-2022-30067

GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the program will allocate for a huge amount of memory, resulting in insufficient memory or program crash...

GHSA-88F6-79X2-XQF3 Apache Jetspeed vulnerable to SQL Injection

Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the 1 role or 2 user parameter to services/usermanager/users/...