3S-Smart Software Solutions CODESYS 资源管理错误漏洞

CODESYS is a controller development system from Germany's 3S-Smart Software Solutions A resource management error vulnerability exists in 3S-Smart Software Solutions CODESYS V3 CmpBlkDrvTcp, which can be exploited by an unauthorized attacker to prevent new TCP connections...

csm 路径遍历漏洞

csm is a csm-aut open source automation and orchestration framework for IOS-XR devices. csm 3.5 and earlier versions have a path traversal vulnerability that stems from a failure of Flask's sendfile function to properly filter special elements in a resource or file path, which can be exploited by...

UBUNTU-CVE-2022-24807

net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access. A user with read-write credentials can exploit the issue. Version 5.9....

CVE-2022-30792

In CmpChannelServer of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new communication channel connections. Existing connections are not affected...

CVE-2022-30791

In CmpBlkDrvTcp of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new TCP connections. Existing connections are not affected...

PT-2022-28156

Name of the Vulnerable Software and Affected Versions Luxon versions 1.x prior to 1.38.1 Luxon versions 2.x prior to 2.5.2 Luxon versions 3.x prior to 3.2.1 Moment versions prior to 2.29.4 Description The issue is related to quadratic N^2 complexity in date and time parsing on specific inputs,...

CVE-2022-34972

So Filter Shop v3.x was discovered to contain multiple blind SQL injection vulnerabilities via the attvalueid , manuvalueid , optvalueid , and subcatevalueid parameters at /index.php?route=extension/module/sofiltershopby/filterdata...

CVE-2021-44915

Taocms 3.0.2 was discovered to contain a blind SQL injection vulnerability via the function Edit category...

GHSA-P64X-8RXX-WF6Q Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc and Extract database functions are subject to SQL injection if untrusted data is used as a kind/lookupname value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected...

Newsletter SQL注入漏洞

Newsletter is a one-click bulk email solution. A security vulnerability exists in the Newsletter v3.x series of releases that stems from a security issue with the zemeznewsletteremail parameter...

WordPress plugin Import any XML or CSV File 代码问题漏洞

WordPress is a blogging platform developed using the PHP language. WordPress Import any XML or CSV File plugin versions prior to 3.6.8 are vulnerable to arbitrary file uploads, which originate from accepting all zip files and automatically extracting the zip file without validating the extracted...

HongCMS 安全漏洞

HongCMS is an open source lightweight content management system CMS. A security vulnerability exists in HongCMS v3.0, which stems from an issue in the /template/edit component that allows an attacker to obtain a shell...

CVE-2022-29097

Dell WMS 3.6.1 and below contains a Path Traversal vulnerability in Device API. A remote attacker could potentially exploit this vulnerability, to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application...

CVE-2022-33095

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist...

ASUS RT-N53 命令注入漏洞

ASUS RT-N53 is a driver application from Asus Taiwan, China. A security vulnerability exists in ASUS RT-N53 version 3.0.0.4.376.3754, which originates from a command injection in the SystemCmd parameter of the apply.cgi interface...

CVE-2022-31298

A cross-site scripting vulnerability in the ads comment section of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request...

Haraj 跨站脚本漏洞

Haraj is a buying and selling platform from Haraj Saudi Arabia. A security vulnerability exists in Haraj version 3.7, which stems from a reflected cross-site scripting issue in the User Upgrade Form...

CVE-2022-32254

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. A customized HTTP POST request could force the application to write the status of a given user to a log file, exposing sensitive user information that could provide valuable guidance to an attacker...

CVE-2022-31447

An XML external entity XXE injection vulnerability in Magicpin v3.4 allows attackers to access sensitive database information via a crafted SVG file...

PT-2022-20391 · Unknown · Tourism Management System

Name of the Vulnerable Software and Affected Versions: Tourism Management System version V 3.2 Description: The issue is related to Cross Site Request Forgery CSRF, which is a type of attack that tricks a user into performing unintended actions on a web application. Recommendations: For Tourism...