PT-2022-19397 · Fortinet · Fortisoar

Name of the Vulnerable Software and Affected Versions: Fortinet FortiSOAR versions prior to 7.2.1 Description: The issue allows an authenticated attacker to write to the underlying filesystem with nginx permissions via crafted HTTP requests, due to multiple relative path traversal vulnerabilities...

PT-2022-19398 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.06 Description: The Solr plugin of Apache OFBiz is configured to automatically make a RMI request on localhost, port 1099 by default. In affected versions, an attacker may exploit this behavior by hosting ...

HashiCorp Boundary 数据伪造问题漏洞

HashiCorp Boundary is an open source solution from the US-based HashiCorp Inc. It automates secure identity-based user access to hosts and services across environments. A security vulnerability exists in HashiCorp Boundary versions prior to 0.10.1 that stems from not properly performing data...

PT-2022-24825 · Pypi · Python-Jwt

Name of the Vulnerable Software and Affected Versions: python-jwt versions prior to 3.3.4 Description: The issue allows an attacker who obtains a JSON Web Token JWT to arbitrarily forge its contents without knowing the secret key. This may enable the attacker to spoof other users' identities,...

PT-2022-16468 · Xpdf · Xpdf

Name of the Vulnerable Software and Affected Versions: Xpdf versions prior to 4.04 Description: The issue is related to an integer overflow check in JPXStream.cc. This lack of check may lead to potential security issues. Recommendations: For versions prior to 4.04, update to version 4.04 or later...

Google Chrome 资源管理错误漏洞

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in versions of Google Chrome prior to 105.0.5195.52, which stems from a mix-up in instructions responsible for freeing memory in WebSQL. An attacker could exploit this vulnerability to...

PT-2022-4523 · Unknown · Istar Ultra

Name of the Vulnerable Software and Affected Versions: iSTAR Ultra versions prior to 6.8.9.CU01 Description: The issue is related to a command injection that could allow an unauthenticated user root access to the system. It is also associated with the lack of data cleaning measures at the...

PT-2022-14565 · WordPress · Sensei Lms

Name of the Vulnerable Software and Affected Versions: Sensei LMS WordPress plugin versions prior to 4.5.0 Description: The issue allows unauthenticated users to access private messages sent to teachers due to improper permissions set in one of its REST endpoints. Recommendations: For versions...

AZL-10714 CVE-2022-38533 affecting package binutils for versions less than 2.37-4

In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfdgetl32 when called from the stripmain function in strip-new via a crafted file...

Vim 资源管理错误漏洞

Vim is a cross-platform text editor. versions prior to Vim 9.0.0258 are vulnerable to a resource management error, which stems from the reuse of the function qffillbuffe after release. No detailed vulnerability details are currently available...

Mozilla Firefox 缓冲区错误漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox versions prior to 104 and Firefox ESR versions prior to 102.1, which originated from incorrectly displaying evidence of memory corruption, and could b...

notrinoserp 安全漏洞

notrinoserp is a web-based ERP by Phương Individual Developer, an accounting system written in PHP and MySql. A security vulnerability exists in versions of notrinoserp prior to 0.7, which stems from its failure to properly restrict rendered UI layers or frames...

Zengenti Contensis Classic 授权问题漏洞

Zengenti Contensis Classic is a content management system from Zengenti UK. A security vulnerability exists in Zengenti Contensis Classic prior to version 15.2.1.79, which stems from a file upload wizard that fails to properly check if a user has been authenticated. The vulnerability can be...

CVE-2022-2790

Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-347 Improper Verification of Cryptographic Signature, and does not properly verify compiled logic PDT files and data blocks data BLD/BLK files...

CVE-2022-35147

DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request...

CVE-2022-38368

An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Because Gateway API functions mishandle authentication, an authenticated VPN user can inject arbitrary commands...

NamelessMC 授权问题漏洞

NamelessMC is a free, easy to use and powerful website software from the NamelessMC team. Suitable for your Minecraft server, it contains tons of features. NamelessMC versions prior to v2.0.2 have an authorization issue vulnerability that stems from improper access control...

PT-2022-16060 · WordPress · Wp-Dbmanager

Name of the Vulnerable Software and Affected Versions: WP-DBManager versions prior to 2.80.8 Description: The issue allows administrators to run arbitrary commands on the server in multisite installations, where only super-administrators should have this capability. Recommendations: For versions...

DEBIAN-CVE-2022-2624

Heap buffer overflow in PDF in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted PDF file...

Intel Wireless Bluetooth 和 Killer Bluetooth 缓冲区错误漏洞

Intel Wireless Bluetooth is a driver tool from Intel USA that can effectively solve some problems with intel bluetooth in win10 system. A buffer error vulnerability exists in IntelR Wireless BluetoothR versions prior to 22.120 and KillerTM BluetoothR versions prior to 22.120, which stems from...