UBUNTU-CVE-2022-25802

Best Practical Request Tracker RT before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment...

Isode SWIFT 信任管理问题漏洞

Isode SWIFT is a multi-platform XMPP client for instant messaging and multi-user chat from Isode UK. A security vulnerability exists in Isode SWIFT version v4.0.2. An attacker could exploit this vulnerability to obtain sensitive information...

CVE-2022-32246

SAP Busines Objects Business Intelligence Platform Visual Difference Application - versions 420, 430, allows an authenticated attacker who has access to BI admin console to send crafted queries and extract data from the SQL backend. On successful exploitation, the attacker can cause limited impac...

CVE-2022-31598

Due to insufficient input validation, SAP Business Objects - version 420, allows an authenticated attacker to submit a malicious request through an allowed operation. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity o...

CVE-2022-31591

SAP BusinessObjects BW Publisher Service - versions 420, 430, uses a search path that contains an unquoted element. A local attacker can gain elevated privileges by inserting an executable file in the path of the affected service...

SAP Business Objects SQL注入漏洞

SAP Business Objects is a business intelligence suite from SAP Germany. An SQL injection vulnerability exists in SAP BusinessObjects Business Intelligence Platform versions 420 and 430, which can be exploited by an authenticated attacker to query and extract SQL backend data through the BI...

Samsung Galaxy Store 输入验证错误漏洞

Samsung Galaxy Store is an application store of Samsung Mobile Samsung in South Korea. versions prior to Samsung Galaxy Store 4.5.41.8 are vulnerable to an input validation error, which could be exploited by attackers to launch campaigns with Galaxy Store privileges...

CVE-2022-31770

IBM App Connect Enterprise Certified Container 4.2 could allow a user from the administration console to cause a denial of service by creating a specially crafted request. IBM X-Force ID: 228221...

GHSA-P64X-8RXX-WF6Q Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc and Extract database functions are subject to SQL injection if untrusted data is used as a kind/lookupname value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected...

Dice 代码问题漏洞

Dice is a front-end and back-end separated personal content management CMS system. A security vulnerability exists in Dice v4.2.0, which stems from allowing any file uploads and can be exploited by an attacker to remotely execute code...

CVE-2022-29484

Operation restriction bypass vulnerability in Space of Cybozu Garoon 4.0.0 to 5.9.0 allows a remote authenticated attacker to delete the data of Space...

Cybozu Garoon 访问控制错误漏洞

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. An access control error vulnerability exists in Cybozu Garoon versions 4.0.0 through 5.9.1, which stems from...

PDFAlto 缓冲区错误漏洞

PDFAlto is a PDF to XML ALTO file converter from the individual developer Patrice Lopez. A security vulnerability exists in PDFAlto v0.4, which stems from the discovery that PDFAlto v0.4 contains a heap buffer overflow via the component /pdfalto/src/pdfalto.cc...

PT-2022-21073 · Totolink · Totolink T6

Name of the Vulnerable Software and Affected Versions: TOTOLINK T6 version 4.1.9cu.5179 B20201015 Description: A stack overflow issue was discovered via the url parameter in the function FUN 00418540. This issue can be exploited, potentially leading to unintended consequences. Recommendations: Fo...

CVE-2022-2058

Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010...

AZL-44847 CVE-2022-2056 affecting package openjpeg2 2.3.1-12

Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010...

TrueConf Server 跨站脚本漏洞

TrueConf Server is a self-hosted and secure video collaboration platform from the Russian company TrueConf. version 4.3.7 of TrueConf Server is vulnerable to a cross-site scripting vulnerability that could be exploited by attackers to execute arbitrary HTML and script code in the user's browser...

Admidio 跨站脚本漏洞

Admidio is an open source member management system from the Admidio team. The system supports member lists, event management, guestbooks, photo albums and downloads. A cross-site scripting vulnerability exists in Admidio version 4.1.2, which stems from the program's lack of checksum filtering of...

L2Blocker Sensor setup screen vulnerable to authentication bypass

Overview L2Blocker provided by SOFTCREATE CORP. contains a vulnerability CWE-288 in which the login authentication is bypassed by using alternative paths or channels for Sensor. Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

HarfBuzz 输入验证错误漏洞

HarfBuzz is a text engine for OpenType fonts. HarfBuzz v4.3.0 is vulnerable to a denial of service vulnerability caused by an integer overflow in the hb-ot-shape-fallback.cc component, which can be exploited to cause a denial of service DoS via an unspecified vector...