xrdp 安全漏洞

xrdp is an open source remote desktop protocol server from Neutrinolabs Labs. A security vulnerability exists in xrdp versions prior to v0.9.21, which stems from the inclusion of a buffer overflow in the xrdpmmchandatain function...

PT-2022-27986 · Jetbrains · Jetbrains Gateway

Name of the Vulnerable Software and Affected Versions: JetBrains Gateway versions prior to 2022.3 Description: The issue allows a client to connect without a valid token if the host consents. This could potentially lead to unauthorized access. Recommendations: For versions prior to 2022.3, update...

PT-2022-36101 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.8 Description: The issue is related to a potential security vulnerability in the btrfs filesystem, specifically in the find parent nodes function during backref walking, which may cause an inode list leak...

CVE-2022-44942

Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function...

PT-2022-23692 · WordPress · Syncee

Name of the Vulnerable Software and Affected Versions: Syncee WordPress plugin versions prior to 1.0.10 Description: The issue allows the leakage of the administrator token, which can be used to take over the administrator's account. Recommendations: For versions prior to 1.0.10, update to versio...

thisAAY Lazy Mouse 访问控制错误漏洞

thisAAY Lazy Mouse is a mouse application from thisAAY. A security vulnerability exists in versions prior to thisAAY Lazy Mouse 2.0.1, which stems from a default configuration that does not require a password and allows an unauthenticated remote user to execute arbitrary code without prior...

Student Information System SQL注入漏洞

Student Information System is a web-based application platform by Carlo Montero, a personal developer. It can help a university or college to manage student information and academic records. A SQL injection vulnerability exists in Student Information System versions prior to 2.1.11. No informatio...

CVE-2022-4182

Inappropriate implementation in Fenced Frames in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass fenced frame restrictions via a crafted HTML page. Chromium security severity: Medium...

PT-2022-6758 · Hitachi · Hitachi Replication Manager

Name of the Vulnerable Software and Affected Versions: Hitachi Replication Manager versions prior to 8.8.5-02 Description: The issue affects Hitachi Replication Manager and is related to an Expression Language Injection vulnerability, allowing code injection. This vulnerability can be exploited b...

SAML 授权问题漏洞

SAML is a library for Ross Kinder individual developers that contains a partial implementation of the saml standard in golang. That is, it allows third parties to authenticate your users, or allows third parties to rely on us to authenticate their users. There is an authorization issue...

CVE-2022-45931

A SQL injection issue was discovered in AAA in OpenDaylight ODL before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/UserStore.java deleteUser function is affected when the API interface /auth/v1/users/ is used...

Nextcloud 安全漏洞

Nextcloud is a suite of open source, self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in versions prior to Nextcloud useroidc 1.2.1, which stems from the fact that sensitive information such as OIDC client...

CVE-2022-40772

Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sensitive data via the report module...

immudb 数据伪造问题漏洞

immudb is a CodeNotary open source immutable database based on zero-trust, SQL and key-value, tamper-resistant, data change history . immudb version 1.4.1 before there is a data forgery problem vulnerability , the vulnerability stems from a malicious server can provide false proof , the client SD...

SolarWinds Security Event Manager 环境问题漏洞

SolarWinds Security Event Manager SolarWinds SEM is an American SolarWinds Inc. for forensics and troubleshooting, as well as a tool to help you manage log data. A cross-site scripting vulnerability exists in SolarWinds Security Event Manager versions prior to 2022.4. The vulnerability stems from...

Sourcegraph 操作系统命令注入漏洞

Sourcegraph is an open source code search and navigation tool from US-based Sourcegraph. An operating system command injection vulnerability exists in Sourcegraph versions prior to 4.1.0, which stems from a command injection vulnerability due to a lack of input validation of the /list-gitolite...

ToolJet 资源管理错误漏洞

ToolJet is an extensible, low-code framework for building business applications from ToolJet.A denial-of-service vulnerability exists in ToolJet prior to version 1.27.0, which stems from improper handling of file size limits. An attacker could exploit this vulnerability to cause site downtime...

CVE-2022-1578 My wpdb < 2.5 - Arbitrary SQL Query via CSRF

The My wpdb WordPress plugin before 2.5 is missing CSRF check when running SQL queries, which could allow attacker to make a logged in admin run arbitrary SQL query via a CSRF attack...

LibreNMS 跨站脚本漏洞

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of network environments and automatic updates. A security vulnerability exists in LibreNMS versions prior to 22.10.0 that stems from the...

PT-2022-27256 · Unknown · Watchtowerhq

Name of the Vulnerable Software and Affected Versions: WatchTowerHQ plugin versions prior to 3.6.16 Description: The issue is related to an Unauth. Arbitrary File Download vulnerability. This means that unauthorized users may be able to download arbitrary files, potentially leading to sensitive...