8821 matches found
CVE-2022-29450
Multiple Cross-Site Request Forgery CSRF vulnerabilities in Admin Management Xtended plugin = 2.4.4 at WordPress...
多款Keysight Technologies产品代码问题漏洞
Keysight Technologies N6854A Geolocation server and Keysight Technologies N6841A RF Sensor are both products of Keysight Technologies, Inc.Keysight Technologies Keysight Technologies N6854A Geolocation server is a geolocation server.Keysight Technologies N6841A RF Sensor is an RF sensor. It is us...
HCL Technologies BigFix Mobile/Modern Client Management 跨站脚本漏洞
HCL Technologies BigFix Mobile/Modern Client Management is a mobile device management software client from HCL Technologies, India. A cross-site scripting vulnerability exists in HCL Technologies BigFix Mobile / Modern Client Management v1.x, v2.0, which can be exploited by an attacker to pop up ...
MinDoc 代码问题漏洞
MinDoc is a Go-based online document management system based on the beego framework developed by Iminho Personal Developer. A security vulnerability exists in MinDoc v2.1-beta.5, which stems from an arbitrary file upload issue. The vulnerability can be exploited to execute arbitrary commands via ...
CVE-2022-1883
SQL Injection in GitHub repository camptocamp/terraboard prior to 2.2.0...
PT-2022-4834
Name of the Vulnerable Software and Affected Versions dpkg versions prior to 1.21.8 dpkg versions prior to 1.20.10 dpkg versions prior to 1.19.8 dpkg versions prior to 1.18.26 Description The issue is related to a directory traversal vulnerability in the Dpkg::Source::Archive component of the...
HashiCorp go-getter 输入验证错误漏洞
HashiCorp go-getter is a library for HashiCorp's Go golang for downloading files or directories from various sources using URLs as the primary form of input. An input validation error vulnerability exists in HashiCorp go-getter version 2.0.2 and prior versions, which stems from the inability to...
PT-2022-19580 · Apache · Apache Archiva
Name of the Vulnerable Software and Affected Versions: Apache Archiva versions prior to 2.2.8 Description: The issue allows any registered user to reset the password for any other user. Recommendations: For versions prior to 2.2.8, update to version 2.2.8 to resolve the issue...
Magento stored cross-site scripting vulnerability in the customer address upload feature
Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by a stored cross-site scripting vulnerability in the customer address upload feature that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious...
Denial of Service (DoS)
Overview Microsoft.AspNetCore.App.Runtime.win-x86 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Denial of Service DoS due to the way the Kestrel web...
Denial of Service (DoS)
Overview Microsoft.AspNetCore.App.Runtime.linux-musl-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Denial of Service DoS due to the way the Kestrel...
Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window...
GHSA-VW57-55F8-C73Q Mattermost Server allows XSS via CSRF
An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF...
GHSA-PM48-CVV2-29Q5 Ansible Uses Plugins That Disclose Credentials
Ansible, all ansibleengine-2.x versions and ansibleengine-3.x up to ansibleengine-3.5, was logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed i...
CVE-2022-29309
mysiteforme v2.2.1 was discovered to contain a Server-Side Request Forgery...
CVE-2022-0346
The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thus causing XSS via error message or RCE if allowurlinclude is turned on...
UBUNTU-CVE-2022-29190
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infinite loop when processing. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available...
Rakuten Mobile Rakuten Casa 安全漏洞
Rakuten Mobile Rakuten Casa is a small base station from Rakuten Mobile Japan, Inc. It is used to improve radio wave conditions for users.An access control error vulnerability exists in Rakuten Mobile Rakuten Casa APFV200 version and APFV141 version, which stems from improper access restrictions....