4743 matches found
CVE-2021-45327
Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remote malisious user execute arbitrary code...
CVE-2022-22680
Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager DSM before 7.0.1-42218-2 allows remote attackers to obtain sensitive information via unspecified vectors...
CVE-2022-22722
A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure. If an attacker were to obtain the SSH cryptographic key for the device and take active control of the local operational network connected to the product they could potentially observe and...
PT-2022-16073 · Google · Tensorflow
Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1 and earlier TensorFlow versions 2.6.3 and earlier TensorFlow versions 2.5.3 and earlier Description: An attacker can craft a TFLite model that would cause an integer overflow in...
strikeentco set 安全漏洞
Strikeentco Set is a personal developer's Npm codebase for setting values in objects via set. A security vulnerability exists in versions prior to strikeentco set 1.0.2, which stems from a problem with the software code. It allows an attacker to exploit the vulnerability to cause a denial of...
WordPress plugin跨站脚本漏洞
WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. WordPress Visual CSS Style Editor plugin in versions prior to 7.5.4 has a cross-site scripting vulnerability that stems from not cleaning up and escaping the wyppagetype parameter. An attacker...
CVE-2021-28962
Stormshield Network Security SNS before 4.2.2 allows a read-only administrator to gain privileges via CLI commands...
CVE-2022-0414
Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0...
DEBIAN-CVE-2021-45079
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2 even without server authentication...
Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
...
Nextcloud Android app 信息泄露漏洞
Nextcloud Android app is an Android-based mobile application for accessing Nextcloud servers from the German company Nextcloud. information disclosure in versions of Nextcloud Android app prior to 3.17.1, the vulnerability stems from a network system or product that has a configuration and other...
CVE-2022-23009
On BIG-IQ Centralized Management 8.x before 8.1.0, an authenticated administrative role user on a BIG-IQ managed BIG-IP device can access other BIG-IP devices managed by the same BIG-IQ system. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
WordPress plugin 跨站请求伪造漏洞
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. cross-site request forgery vulnerability exists in versions prior to Wordpress Plugin Simple Download Monitor 3.9.9, which...
Digital COVID Certificates 信任管理问题漏洞
Digital COVID Certificates is a digital COVID certificate for the European Union, designed to help facilitate the free movement and travel of EU citizens and non-EU nationals within the EU. A security vulnerability exists in Digital COVID Certificates that stems from the product allowing the use ...
PT-2022-15054 · Unknown · Wasmcloud Host Runtime
Name of the Vulnerable Software and Affected Versions: wasmCloud Host Runtime versions prior to 0.52.2 Description: The issue affects the security model of actors in the wasmCloud Host Runtime, allowing them to bypass capability authorization. Normally, actors are required to declare their...
PT-2022-10300 · Libspf2 +3 · Libspf2 +3
Name of the Vulnerable Software and Affected Versions: libspf2 versions prior to 1.2.11 Description: The issue is a heap-based buffer overflow that might allow remote attackers to execute arbitrary code via an unauthenticated e-mail message from anywhere on the Internet with a crafted SPF DNS...
CVE-2022-0260
Cross-site Scripting XSS - Stored in GitHub repository pimcore/pimcore prior to 10.2.7...
CVE-2021-25005
The SEUR Oficial WordPress plugin before 1.7.0 does not sanitize and escape some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
WordPress plugin 跨站脚本漏洞
WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Landing Page Builder plugin prior to version...