Mattermost Server is vulnerable to channel invisibility DoS via misformatted post

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to cause a denial of service channel invisibility via a misformated post...

GHSA-FJW4-39PG-VF4F Apache Karaf vulnerable to relative path traversal

Apache Karaf Config service provides a install method via service or MBean that could be used to travel in any directory and overwrite existing file. The vulnerability is low if the Karaf process user has limited permission on the filesystem. Any Apache Karaf version before 4.2.5 is impacted. Use...

Opencast 授权问题漏洞

Opencast is a live video support software for large-scale automated video capture, management and distribution from the Opencast organization. An authorization issue vulnerability exists in Opencast prior to version 10.14 and prior to version 11.7, which stems from the fact that a user can pass i...

Google Chrome 资源管理错误漏洞

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in versions of Google Chrome prior to 102.0.5005.61, which stems from a mix-up in the instructions responsible for freeing memory in the Performance Manager component program. An attacker...

PT-2022-14131 · Publify · Publify

Name of the Vulnerable Software and Affected Versions: publify versions prior to 9.2.9 Description: The issue allows for the unrestricted upload of files with dangerous types. This can be exploited to manipulate requests and bypass protections, potentially leading to stored XSS attacks...

Providence 跨站脚本漏洞

Providence is the "back-end" component of CollectiveAccess, a set of web-based applications from the CollectiveAccess community in the United States. A security vulnerability exists in Providence versions prior to 1.8, which stems from a cross-site scripting vulnerability...

RegionProtect 参数注入漏洞

RegionProtect is a plugin. A security vulnerability exists in versions of RegionProtect prior to 1.1.0, which stems from a YAML injection issue in the application. An attacker can exploit the vulnerability by passing mismatched parameters to achieve denial of service attacks...

Trudesk代码问题漏洞

Chris Brame Trudesk is an open source helpdesk/ticketing solution from Chris Brame USA. A security vulnerability exists in versions prior to Trudesk 1.2.2 that stems from the unrestricted upload of dangerous files...

CVE-2022-29883

A vulnerability has been identified in SICAM T All versions V3.0. Affected devices do not restrict unauthenticated access to certain pages of the web interface. This could allow an attacker to delete log files without authentication...

Google TensorFlow输入验证错误漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. An input validation error vulnerability exists in Google TensorFlow versions prior to 2.9.0, prior to 2.8.1, prior to 2.7.2, and prior to 2.6.4, which stems from the fact that tf.rawops.StagePee...

Go Ethereum 资源管理错误漏洞

Go Ethereum is an official Go implementation of the Ether protocol for the Ethereum community. A resource management error vulnerability exists in Go Ethereum versions prior to 1.10.17. An attacker exploiting this vulnerability could systematically cause a crash when a node sends a specially...

Nextcloud 安全漏洞

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Deck versions prior to 1.4.8, 1.5.6, and 1.6.1. An attacker exploited the vulnerability to move a stack with...

Handysoft Groupware 输入验证错误漏洞

Handysoft Handy Groupware is an office collaboration solution from Handysoft Korea. The product supports features such as meeting management, attendance management, and human resource assessment. A security vulnerability exists in Handysoft Groupware for Windows, which originates from incorrect...

JFrog Artifactory 安全漏洞

Jfrog JFrog Artifactory is an open source, general-purpose Artifact repository manager from Israel's Jfrog that supports clustering and high-availability Docker registries, and provides an end-to-end solution for tracking artifact automation from development to production. A security vulnerabilit...

GHSA-FXJ8-CQCP-3VGQ Jenkins cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to inject arbitrary web script or HTML via the iconSize cookie...

PT-2022-20231 · Unknown +2 · Needrestart +2

Name of the Vulnerable Software and Affected Versions: needrestart versions 0.8 through 3.5 before 3.6 Description: The issue is related to local privilege escalation. Regexes used to detect Perl, Python, and Ruby interpreters are not anchored, allowing a local user to escalate privileges when...

CVE-2022-24388

Vulnerability in rconfig “date” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fidelis Network...

Publify 安全漏洞

Publify is a simple but full-featured web publishing software.An access control error vulnerability exists in versions of Publify prior to 9.2.8. The vulnerability stems from an access control error in draft mode, which could be exploited by an attacker to comment on articles in draft mode...

Publify 安全漏洞

Publify is a simple but full-featured web publishing software.A code injection vulnerability exists in versions of Publify prior to 9.2.8, which stems from the existence of a code injection vulnerability, for which no detailed vulnerability details are currently available...

PT-2022-13274 · Publify · Publify

Name of the Vulnerable Software and Affected Versions: publify/publify versions prior to 9.2.8 Description: The issue is related to code injection in the GitHub repository publify/publify. Recommendations: For versions prior to 9.2.8, update to version 9.2.8 or later to resolve the issue...