K15653: Multiple PHP vulnerabilities

Security Advisory Description Description Following are descriptions of various PHP gdImageCrop vulnerabilities: CVE-2013-7226 Integer overflow in the gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before 5.5.9 allows remote attackers to cause a denial of service application crash or possibly...

K15480: PHP vulnerability CVE-2012-2688

Security Advisory Description Description Unspecified vulnerability in the phpstreamscandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has unknown impact and remote attack vectors, related to an "overflow." CVE-2012-2688 Impact None. F5 products are not...

CVE-2011-10002 weblabyrinth labyrinth.inc.php Labyrinth sql injection

A vulnerability classified as critical has been found in weblabyrinth 0.3.1. This affects the function Labyrinth of the file labyrinth.inc.php. The manipulation leads to sql injection. Upgrading to version 0.3.2 is able to address this issue. The identifier of the patch is...

CVE-2022-37705

A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar with specific arguments that are controllable by the attacker. This program mishandles the...

PT-2022-5520 · Microsoft · Windows Dhcp Client +1

Name of the Vulnerable Software and Affected Versions: Windows DHCP Client affected versions not specified Description: The issue is related to insecure privilege management in the Windows DHCP client, which can be exploited to elevate privileges. This allows an attacker to affect the system. No...

CVE-2022-36961

A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution...

Sql injection

A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution...

Exploit for OS Command Injection in Apache Spark

CVE-2022-33891 Apache Spark Shell Command Injection Vulnerabil...

@mohamed.abdelall/omni-backend (>=1.0.0, <=1.1.53), generator-rest (0.2.0) +7 more potentially affected by CVE-2022-25871 via querymen (2.1.4)

querymen NPM version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on querymen and may be impacted: - @mohamed.abdelall/omni-backend =1.0.0, =0.0.1, =1.0.0, =1.0.0, =0.1.0, =1.0.14, =1.0.6, =1.4.10 - vulnogram 0.1.0-rc1 Source cves: CVE-2022-25871...

@kitinggan/didactic-eureka (1.1.4), @qsb-cli-test/command (1.0.10) +44 more potentially affected by CVE-2013-4940 via yui (>=3.5.0, <=3.10.3)

yui NPM version =3.5.0, =1.0.8, =1.0.8, =1.0.6, =1.0.6, =0.1.0, =0.0.1, =0.0.1, =0.0.1, =0.1.1, =0.1.4 and more Source cves: CVE-2013-4940 Source advisory: OSV:GHSA-X5HJ-47VV-53P8...

RW Divi Unite Gallery <= 1.0 - Security Bypass via Outdated Freemius

The plugin is vulnerable to a security bypass due to the use of a known vulnerable component, Freemius 2.2.4. The plugin uses Freemius 1.0.0 and is therefore vulnerable. The core issue that causes the vulnerability is in the setdboption function, which is exposed to any authenticated user with no...

RW Divi Unite Gallery <= 1.0 - Security Bypass via Outdated Freemius

The plugin is vulnerable to a security bypass due to the use of a known vulnerable component, Freemius 2.2.4. The plugin uses Freemius 1.0.0 and is therefore vulnerable. The core issue that causes the vulnerability is in the setdboption function, which is exposed to any authenticated user with no...

CVE-2022-21174

Improper access control in a third-party component of IntelR QuartusR Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable escalation of privilege via local access...

TIBCO Security Advisory: January 11, 2022 - TIBCO eFTL -2021-43055

TIBCO eFTL Token Caching Vulnerability Original release date: January 11, 2022 Last revised:--- CVE-2021-43055 Source: TIBCO SoftwareInc. Products Affected TIBCO eFTL - Community Edition versions 6.7.2 and below TIBCO eFTL - Developer Edition versions 6.7.2 and below TIBCO eFTL - Enterprise Editi...

HUAWEI HarmonyOS 参数注入漏洞

Huawei HarmonyOS is an operating system from Huawei, a Chinese company that provides a microkernel-based distributed operating system. A security vulnerability exists in Huawei HarmonyOS, which stems from a parameter injection type of vulnerability in a component of Huawei HarmonyOS. No details o...

ferris-rich-input (0.0.1) potentially affected by CVE-2021-37695 via ckeditor4 (4.14.0)

ckeditor4 NPM version 4.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on ckeditor4 and may be impacted: - ferris-rich-input 0.0.1 Source cves: CVE-2021-37695 Source advisory: OSV:GHSA-M94C-37G6-CJHC...

Information disclosure

GENIVI Diagnostic Log and Trace DLT provides a log and trace interface. In versions of GENIVI DLT between 2.10.0 and 2.18.6, a configuration file containing the special characters could cause a vulnerable component to crash. All the applications which are using the configuration file could fail t...

CVE-2021-29507 dlt-daemon could crash if there is special character in dlt.conf

GENIVI Diagnostic Log and Trace DLT provides a log and trace interface. In versions of GENIVI DLT between 2.10.0 and 2.18.6, a configuration file containing the special characters could cause a vulnerable component to crash. All the applications which are using the configuration file could fail t...

@agentlab/ldkg-ui-react (>=0.1.7, <=0.1.12), @belvoly-vue-aioa/tinymce (>=0.1.6, <=0.1.9) +56 more potentially affected by CVE-2024-21911 via tinymce (>=5.0.6, <=5.5.1)

tinymce NPM version =5.0.6, =0.1.7, =0.1.6, =0.0.1, =9.0.0-alpha.5, =0.1.2, =0.8.4, =0.18.0, =0.0.1-alpha.9, =15.0.1, =1.2.2, =0.17.0, =0.1.0, =0.0.1, =0.0.4 - @yanghp/amis 1.1.0 and more Source cves: CVE-2024-21911 Source advisory: OSV:GHSA-W7JX-J77M-WP65...

Denial Of Service (DoS)

crypto/ssh in github.com/golang/go is vulnerable to Denial Of Service DoS. The vulnerability is possible because of a nil pointer dereference in the component...