PT-2022-5707 · D Link · D-Link Dir-882

Name of the Vulnerable Software and Affected Versions: D-Link DIR-882 versions 1.10B02 through 1.20B06 Description: The issue is related to a buffer overflow error in the webGetVarString function of the D-Link DIR-882 wireless router's firmware. This can be exploited by a remote attacker to execu...

PT-2022-18672 · Osisoft · Osisoft-Pi-Web-Connector

Name of the Vulnerable Software and Affected Versions: osisoft-pi-web-connector versions 0.15.0 through 0.43.0 Description: The Foundry Magritte plugin osisoft-pi-web-connector was found to be logging in a manner that captured authentication requests. Recommendations: For osisoft-pi-web-connector...

CVE-2022-44622

In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive...

PT-2022-25297 · Ibm · Ibm Mq Appliance

Name of the Vulnerable Software and Affected Versions: IBM MQ Appliance versions 9.2 CD through 9.3 LTS Description: The issue allows an authenticated user to impersonate another user on the system because it does not invalidate the session after logout. Recommendations: For IBM MQ Appliance...

PT-2022-24940 · Fluentd · Fluentd

Name of the Vulnerable Software and Affected Versions: Fluentd versions 1.13.2 through 1.15.2 Description: A remote code execution vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. This issue...

Sudo 缓冲区错误漏洞

Sudo is a program used on Unix-like systems that allows users to execute commands in a secure manner with special privileges. A buffer error vulnerability exists in Sudo versions 1.8.0 through 1.9.12, which stems from the presence of an array out-of-bounds error that could result in a heap-based...

CVE-2022-43995

Sudo 1.8.0 through 1.9.12, with the crypt password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer...

CVE-2022-41974

multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege...

CVE-2022-3400

The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the brickssavepost AJAX action in versions 1.0 to 1.5.3. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to edit any page, post, or template...

Litespeed Technologie OpenLiteSpeed 代码问题漏洞

Litespeed Technologie OpenLiteSpeed is an open source web server from Litespeed Technologie. A code issue vulnerability exists in LiteSpeed Technologies OpenLiteSpeed versions prior to 1.6.15 through 1.7.16.1, which stems from its Web Server Container allowing untrusted path searches leading to a...

CVE-2022-42468

Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol...

PT-2022-27019 · Baramundi · Baramundi Management Suite

Name of the Vulnerable Software and Affected Versions: baramundi Management Suite versions 2021 R1 through 2022 R1 Description: The issue allows remote code execution. It is estimated that a significant number of devices worldwide could be affected, although the exact number is not specified. The...

Joomla! 跨站脚本漏洞

Joomla! is a set of forum components used in the Joomla! content management system. A security vulnerability exists in Joomla! versions 4.0.0 through 4.2.3 that stems from insufficient filtering of user input...

Gradle 安全漏洞

Gradle is a set of JVM-based project building tools from Gradle, Inc. that supports maven, Ivy repositories, and more. A security vulnerability exists in Gradle Enterprise versions 2022.3 through 2022.3.3. A remote attacker can access application data by exploiting the vulnerability...

@agoric/access-token (>=0.4.16-dev-23c942c.0, <=0.4.16-dev.0), @agoric/assert (>=0.1.0, <=0.3.15-dev.2) +100 more potentially affected by unknown CVE via ses (>=0.0.1, <=0.15.24)

ses NPM version =0.0.1, =0.4.16-dev-23c942c.0, =0.1.0, =1.2.0, =1.3.0, =0.1.0, =0.10.8-dev.0, =0.2.0, =1.5.1, =0.5.6-dev-f662032.0, =0.0.1, =0.1.1, =0.0.9, =0.1.1, =0.2.0, =0.5.30-dev-fe997f2.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WHPX-Q3RQ-W8JC...

nopCommerce 输入验证错误漏洞

nopCommerce is an open source general purpose e-commerce platform. A security vulnerability exists in nopCommerce versions 4.10 to 4.50.1, which is caused by an open redirection in the ChangePassword function, SignInCustomerAsync function, SuccessAuthentication method, and NopRedirectResultExecut...

GHSA-5QWQ-G2HX-R6F7 Hessian Lite for Apache Dubbo deserialization vulnerability

A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version...

PT-2022-24829 · Tuleap +1 · Tuleap +1

Name of the Vulnerable Software and Affected Versions: Tuleap versions 12.9.99.228 through 14.0.99.23 Description: The issue concerns improper verification of authorizations when updating the branch prefix used by the GitLab repository integration. Authenticated users can change the branch prefix...

FortiTester 操作系统命令注入漏洞

FortiTester is a Fortinet professional-based network traffic testing tool from FortiTester, Inc. A security vulnerability exists in FortiTester versions 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, and 7.0.0 through 7.1.0, which stems from improper invalidation of special elements used in OS command...

Liferay Portal 跨站脚本漏洞

Liferay Portal is a J2EE-based portal solution from Liferay, Inc. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network and more. A security vulnerability exists in Liferay Portal...