4743 matches found
CVE-2022-23233
StorageGRID formerly StorageGRID Webscale versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service DoS of the Local Distribution Router LDR service...
CVE-2022-23779
Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses...
Webmin 访问控制错误漏洞
Webmin is the Webmin community's set of Web-based system management tools for Unix-like operating systems. webmin versions prior to 1.990 have an elevation of privilege vulnerability that stems from a faulty program to high-level local procedure calls. An attacker could exploit this vulnerability...
CVE-2022-23912
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting...
CVE-2022-23911
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statement when retrieving a testimonial to edit, leading to a SQL Injection...
CVE-2021-24864
The WP Cloudy, weather plugin WordPress plugin before 4.4.9 does not escape the postid parameter before using it in a SQL statement in the admin dashboard, leading to a SQL Injection issue...
WordPress 跨站脚本漏洞
WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. cross-site scripting vulnerability exists in versions of WordPress WP-Paginate plugin prior to 2.1.4, which stems from the...
CVE-2022-0723
Cross-site Scripting XSS - Reflected in GitHub repository microweber/microweber prior to 1.2.11...
CVE-2022-0763
Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 1.3...
AZL-8862 CVE-2022-23308 affecting package libxml2 for versions less than 2.9.13-1
valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes...
CVE-2022-24341
In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user...
PT-2022-17215 · Fscrypt +1 · Fscrypt +1
Name of the Vulnerable Software and Affected Versions: fscrypt versions prior to 0.3.3 Description: The PAM module for fscrypt does not adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a...
CVE-2022-25838
Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept...
CVE-2022-24633
All versions of FileCloud prior to 21.3 are vulnerable to user enumeration. The vulnerability exists in the parameter "path" passing "/SHARED/". A malicious actor could identify the existence of users by requesting share information on specified share paths...
AZL-8805 CVE-2019-25058 affecting package usbguard for versions less than 1.1.0-1
An issue was discovered in USBGuard before 1.1.0. On systems with the usbguard-dbus daemon running, an unprivileged user could make USBGuard allow all USB devices to be connected in the future...
Wolfssl 信任管理问题漏洞
wolfSSL CyaSSL is a small, portable embedded SSL programming library for use by embedded systems developers from wolfSSL, USA. A trust management issue vulnerability exists in wolfSSL versions prior to 5.2.0, which stems from the inability of TLS 1.3 servers to properly enforce mutual...
CVE-2022-24295
Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially crafted URL...
AZL-8610 CVE-2021-44141 affecting package samba 4.12.5-7
All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succee...
NPM url-parse 安全漏洞
Url-Parse is a small Url parser that works seamlessly across Node.js and browser environments.An authorization bypass vulnerability exists in versions of NPM url-parse prior to 1.5.8, which can be exploited by attackers to bypass authorization via a user-controlled key...