Microweber 代码问题漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A code issue vulnerability exists in Microweber versions prior to 1.3.2, which stems fro...

i18n 输入验证错误漏洞

i18n is a Macaron open source package . It provides internationalization and localization middleware for Macaron applications. An input validation error vulnerability exists in versions of i18n prior to 0.5.0, which stems from a problem with an unknown function in the file i18n.go that results in...

Brave 安全漏洞

Brave is a fast, private and secure web browser from Brave USA. A security vulnerability exists in Brave Browser versions prior to 1.43.88 that could allow a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file containing an ipfs:// or ipns:// URL...

CVE-2022-4690 Cross-site Scripting (XSS) - Stored in usememos/memos

Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.9.0...

CVE-2022-45407

If an attacker loaded a font using FontFace on a background worker, a use-after-free could have occurred, leading to a potentially exploitable crash. This vulnerability affects Firefox 107...

CVE-2022-34469

When a TLS Certificate error occurs on a domain protected by the HSTS header, the browser should not allow the user to bypass the certificate error. On Firefox for Android, the user was presented with the option to bypass the error; this could only have been done by the user explicitly. This bug...

JetBrains IntelliJ IDEA 安全漏洞

JetBrains IntelliJ IDEA is an integrated development environment for the Java language from the Czech company JetBrains. A security vulnerability exists in JetBrains IntelliJ IDEA prior to version 2022.3.1, which is caused by the "Validate JSP file" operation using the HTTP protocol to download t...

ALPINE-CVE-2022-47629

Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser...

CVE-2022-46421 Apache Airflow Hive Provider: Hive Provider RCE vulnerability with hive_cli_params

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider: before 5.0.0...

AZL-34950 CVE-2021-33640 affecting package libtar for versions less than 1.2.20-11

After tarclose, libtar.c releases the memory pointed to by pointer t. After tarclose is called in the list function, it continues to use pointer t: freelonglinklongnamet-thbuf . As a result, the released memory is used use-after-free...

CVE-2022-4050

The JoomSport WordPress plugin before 5.2.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2022-4058

The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS code later on in another page, which could lead to Stored XSS issue when an attacker makes a logged in admin open a malicious URL or page under their control...

National Sleep Research Resource 跨站脚本漏洞

National Sleep Research Resource is an open source national sleep research resource system by National Sleep Research Resource. A cross-site scripting vulnerability exists in National Sleep Research Resource versions prior to 59.0.0 that stems from the presence of unknown functionality...

CVE-2022-4438

Use after free in Blink Frames in Google Chrome prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

PT-2022-27224 · Tsolucio · Corebos

Name of the Vulnerable Software and Affected Versions: corebos versions prior to 8.0 Description: The issue is related to PHP Remote File Inclusion in the GitHub repository tsolucio/corebos. Recommendations: For versions prior to 8.0, update to version 8.0 or later to resolve the issue...

IFM Moneo Appliance 授权问题漏洞

The IFM Moneo Appliance QHA200 and the IFM Moneo Appliance QHA210 are both pieces of hardware from IFM Germany that are used to operate Moneo in the production process. An authorization issue vulnerability exists in IFM Moneo Appliance versions prior to 1.9.3. An attacker could exploit this...

PT-2022-24773 · WordPress · Dokan

Name of the Vulnerable Software and Affected Versions: Dokan WordPress plugin versions prior to 3.7.6 Description: The issue is related to a SQL injection that can be exploited by unauthenticated users due to improper sanitization and escaping of a parameter in a SQL statement. Recommendations: F...

ZKTeco ZKBio Time 跨站脚本漏洞

ZKTeco ZKBio Time is a powerful web-based time and attendance management software from ZKTeco, China. A security vulnerability exists in ZKTeco ZKBio Time prior to version 3.1-164, which originates from a vulnerability that allows users to embed malicious code in the Web UI...

xrdp 安全漏洞

xrdp is an open source remote desktop protocol server from Neutrinolabs Labs. A security vulnerability exists in xrdp versions prior to v0.9.21, which stems from the inclusion of a buffer overflow in the xrdpmmchandatain function...

PT-2022-27986 · Jetbrains · Jetbrains Gateway

Name of the Vulnerable Software and Affected Versions: JetBrains Gateway versions prior to 2022.3 Description: The issue allows a client to connect without a valid token if the host consents. This could potentially lead to unauthorized access. Recommendations: For versions prior to 2022.3, update...