4743 matches found
D-BUS 数据伪造问题漏洞
D-BUS is a message bus system, which is mainly used for inter-process communication and remote procedure calls. A security vulnerability exists in D-BUS versions prior to 1.12.24-0+deb11u1, which stems from the inclusion of multiple vulnerabilities in D-Bus that can be exploited by an attacker to...
tiny-csrf 安全漏洞
tiny-csrf is a small csrf library by Vincent Alexander Saulys personal developer. It is intended to replace the work done by csurf before it was removed. A security vulnerability exists in versions of tiny-csrf prior to 1.1.0, which stems from the fact that cookies are not encrypted, and thus CSR...
PT-2022-21443 · Puppet +1 · Puppetlabs-Apt +1
Name of the Vulnerable Software and Affected Versions: puppetlabs-apt versions prior to 9.0.0 Description: Command injection is possible in the puppetlabs-apt module. A malicious actor can exploit this issue if they can provide unsanitized input to the module. This condition is rare in most...
Dell Hybrid Client 路径遍历漏洞
Dell Hybrid Client is a software application from Dell USA Inc. It provides a client computing software with hybrid cloud management capabilities. A path traversal vulnerability exists in Dell Hybrid Client versions prior to 1.8. The vulnerability stems from a failure of a networked system or...
Heimavista Rpage 跨站脚本漏洞
Heimavista Rpage is a content management system from the Chinese company Heimavista. A cross-site scripting vulnerability exists in versions of Heimavista Rpage prior to v5.4.103, which stems from insufficient filtering of the platform's web URLs that allows an unauthenticated, remote attacker to...
CVE-2022-35257
A local privilege escalation vulnerability in UI Desktop for Windows Version 0.55.1.2 and earlier allows a malicious actor with local access to a Windows device with UI Desktop to run arbitrary commands as SYSTEM...
PT-2022-22656 · Unknown · Rocket.Chat
Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions prior to 5 Description: A information disclosure issue exists where the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the user's access permission...
Crestron AirMedia 安全漏洞
Crestron AirMedia is Crestron's unlimited sharing platform for laptops, PCs, smartphones or tablets. A security vulnerability exists in Crestron AirMedia for Windows prior to version 5.5.1.84, which stems from insecure inherited privileges, and can be exploited by an attacker to initiate a system...
PYSEC-2022-283
Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3...
OctoPrint 安全漏洞
OctoPrint is an application. Provides a fast web interface for controlling consumer 3D printers. A security vulnerability exists in versions prior to OctoPrint 1.8.3 that stems from incorrect privilege management...
NLnet Labs Unbound 资源管理错误漏洞
NLnet Labs Unbound is an open source DNS server from NLnet Labs. A security vulnerability exists in versions prior to NLnet Labs Unbound 1.16.3, which stems from the fact that Unbound is not affected by high CPU usage, but still requires resources to resolve malicious delegates, and will keep...
CVE-2022-3141
The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language via the settings page containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected...
openSUSE Tumbleweed 授权问题漏洞
openSUSE Tumbleweed is an open source system from the openSUSE project. A security vulnerability exists in openSUSE Tumbleweed versions prior to 1.5.2-6.1, which stems from the pamaccess.so module not properly restricting logins if a user attempts to connect from an IP address that is not...
PT-2022-33845 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.61 Description: A buffer overflow issue exists in the mcp smbus write function, which may potentially lead to security vulnerabilities. The actual impact and attack plausibility have not yet been proven...
CVE-2022-1194
The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability...
CVE-2022-40306
The login form /Login in ECi Printanista Hub formerly FMAudit Printscout before 5.5.2 July 2023 performs expensive RSA key-generation operations, which allows attackers to cause a denial of service DoS by requesting that form repeatedly...
MB CONNECT LINE mymbCONNECT24 安全漏洞
MB CONNECT LINE mymbCONNECT24 is an in-house remote maintenance solution for virtual environments from MB CONNECT LINE, Germany. A security vulnerability exists in MB CONNECT LINE mymbCONNECT24, mbCONNECT24, Helmholz myREX24, and myREX24.virtual v2.11.2 and prior versions, which originates from a...
Matrix matrix-appservice-irc 资源管理错误漏洞
matrix-appservice-irc is a bridge for Matrix. This bridge passes all IRC messages to Matrix and all Matrix messages to IRC. A resource management error vulnerability exists in Matrix matrix-appservice-irc prior to version 0.35.0, which stems from an error in the underlying matrix-org/node-irc...
Theonedev Onedev 授权问题漏洞
Theonedev Onedev is a JAVA-based all-in-one DevOps platform from the Theonedev team. The platform supports container build, orchestration, CI, Git management, team collaboration and other features to help developers build a simple, powerful development platform. Theonedev An authorization issue...