PT-2022-22112 · Zalando · Zalando Skipper

Name of the Vulnerable Software and Affected Versions: Zalando Skipper versions prior to 0.13.218 Description: A query predicate could be bypassed via a prepared request. Recommendations: For versions prior to 0.13.218, update to version 0.13.218 or later to resolve the issue...

BSA-2022-1977

Security Advisory ID : BSA-2022-1977 Component : TLS/SSL Revision : 1.0 In Brocade SANnav versions before v2.2.0.2, and v2.1.1.8, the implementation of TLS/SSL Server Supports the Use of Static Key Ciphers ssl-static-key-ciphers on ports 443 & 18082. Affected Products Brocade SANnav versions befo...

Knot Resolver 安全漏洞

Knot Resolver is a caching DNS resolver implementation that includes a resolver library and daemon. A security vulnerability exists in Knot Resolver versions prior to 5.5.1, which stems from a possible DNS cache poisoning when attempting to limit forwarding operations via a filter...

Schneider Electric IGSS Data Server 缓冲区错误漏洞

The Schneider Electric IGSS Data Server is a data server for the Interactive Graphics Scada System from Schneider Electric France. A buffer error vulnerability exists in versions prior to Schneider Electric IGSS Data Server 15.0.0.22140, which stems from an application boundary error. A remote...

Vim 缓冲区错误漏洞

Vim is a cross-platform text editor. A security vulnerability exists in versions prior to Vim 8.2 that stems from the presence of a heap-based buffer overflow...

AutomationDirect C-more EA9 HMI 代码问题漏洞

AutomationDirect DirectLOGIC is a programmable logic controller from AutomationDirect, Inc. A code issue vulnerability exists in the AutomationDirect C-more EA9 HMI that stems from a security issue in the installation directory that could allow an attacker to execute code during installation and...

CVE-2022-21935

A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 allows unverified password change...

CVE-2022-32155 Universal Forwarder management services allows remote login by default

In universal forwarder versions before 9.0, management services are available remotely by default. When not required, it introduces a potential exposure, but it is not a vulnerability. If exposed, we recommend each customer assess the potential severity specific to your environment. In 9.0, the...

CVE-2022-21937

Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 could allow a user to inject malicious code into the web interface...

CVE-2022-32256

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to low privileged users accessing privileged information...

Jupyter Notebook 安全漏洞

Jupyter Notebook is a suite of open source web applications for creating and sharing code and illustrative text documents. A security vulnerability exists in Jupyter Notebook versions prior to 6.4.12, which stems from the fact that any authenticated request can access files...

Couchbase Server 日志信息泄露漏洞

Couchbase Server is a distributed, open source NoSQL non-relational database from Couchbase, Inc. that supports data querying, full-text searching, and active global replication. A security vulnerability exists in Couchbase Server versions prior to 7.0.4 in the Couchbase Server 7.x series, and...

OESA-2022-1700 ruby security update

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks such as Perl. Security Fixes: There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and...

PT-2022-6745 · Gpgme +11 · Gpgme +11

Name of the Vulnerable Software and Affected Versions: GnuPG versions prior to 2.3.7 Description: The issue is related to insufficient neutralization of special elements in a request, allowing a remote attacker to access and compromise confidential data. In unusual situations where an attacker...

DEBIAN-CVE-2022-26377

Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions...

Envoy 安全漏洞

Envoy is an open source distributed proxy server. security vulnerability exists in versions prior to Envoy 1.22.1, which stems from secompressors accumulating decompressed data into an intermediate buffer before overwriting the body in decode/encodeBody, which can be exploited by attackers to...

Mechanize 信息泄露漏洞

Mechanize is an open source ruby library from Sparkle Motion. It is used to automate interactions with websites. A security vulnerability exists in versions of Mechanize prior to 2.8.5 that stems from an authorization header that leaks after redirecting to a different port on the same site...

Gogs 跨站脚本漏洞

Gogs Go Git Service is a self-service Git hosting service based on the Go language by the GOGS team, which supports creating and migrating public/private repositories, adding and deleting repository collaborators, and so on. A cross-site scripting vulnerability exists in Gogs versions prior to...

ToolJet 安全漏洞

ToolJet is an extensible low-code framework for building business applications from ToolJet. A security vulnerability exists in ToolJet versions prior to v1.16.0...

FacturaScripts 跨站脚本漏洞

FacturaScripts is an open source ERP software from Carlos Garcia, an individual developer in Spain. A security vulnerability exists in FacturaScripts versions prior to 2022.1 that stems from the presence of a stored cross-site scripting XSS vulnerability...