XML External Entity (XXE) Injection

org.apache.any23:apache-any23-core is vulnerable to XML external entity XXE injection attacks. An attacker is able to view files and to interact with any back-end or external systems that the application itself can access due to the vulnerable RDFa XSLTStylesheet extractor component...

PT-2022-11352 · Aruba · Aos-Cx +7

Name of the Vulnerable Software and Affected Versions: Aruba CX 6200F Switch Series versions AOS-CX 10.06.xxxx: 10.06.0170 and below Aruba 6300 Switch Series versions AOS-CX 10.06.xxxx: 10.06.0170 and below Aruba 6400 Switch Series versions AOS-CX 10.06.xxxx: 10.06.0170 and below Aruba 8320 Switc...

PT-2022-11349 · Aruba · Aos-Cx +7

Name of the Vulnerable Software and Affected Versions: Aruba CX 6200F Switch Series versions 10.06.xxxx through 10.06.0170 and below Aruba 6300 Switch Series versions 10.06.xxxx through 10.06.0170 and below, 10.07.xxxx through 10.07.0050 and below, 10.08.xxxx through 10.08.1030 and below Aruba 64...

Denial Of Service (DoS)

gpac is vulnerable to denial of service. The vulnerability exists due to a null pointer dereference vulnerability exists in the gfsgvrmlmfappend function,...

Open Redirect

rudloff/alltube is vulnerable to open redirect. An attacker can redirect users to malicious URLs through the REQUESTURI parameter in index.php...

Denial of service attacks due to use of vulnerable version of apache-commons-compress package

Affected versions of Atlassian Jira Service Server and Data Center allow an unauthenticated attacker to perform a denial of service attack against services that use the apache-commons-compress package. The affected versions are before version 8.13.19, from version 8.14.0 before 8.20.6, from versi...

Open Redirect in koa-remove-trailing-slashes

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...

PT-2022-2530

Name of the Vulnerable Software and Affected Versions Redis versions prior to 7.0.0 and 6.2.7 Description The issue is related to weaknesses in the Lua script execution environment in Redis, which can be exploited by a less privileged user to inject Lua code that will execute with potentially...

Denial Of Service (DoS)

tensorflow is vulnerable to denial of service. When the default settings are used, an attacker can cause the application to crash due to a null pointer dereference in the BuildXlaCompilationCache in xla platform info.cc...

Business Logic Errors in SilverStripe Framework

SilverStripe Framework prior to version 4.10.1 is vulnerable to business logic errors...

Denial Of Service (DoS)

webkit2gtk:edge is vulnerable denial of service...

PT-2022-11876 · Codex · Codex

Name of the Vulnerable Software and Affected Versions: Codex versions prior to 1.4.0 Description: A Cross Site Scripting XSS issue exists via the Notebook/Page name field, allowing malicious users to execute arbitrary code through a crafted http code in a .json file. Recommendations: For versions...

PT-2022-12096 · Reolink · Reolink Rlc-410W

Name of the Vulnerable Software and Affected Versions: reolink RLC-410W version 3.0.0.136 20121102 Description: A denial of service issue exists in the cgiserver.cgi JSON command parser functionality. This can be triggered by a specially-crafted HTTP request, leading to a reboot. The GetPtzPreset...

PT-2022-11234 · Reolink · Reolink Rlc-410W

Name of the Vulnerable Software and Affected Versions: reolink RLC-410W version 3.0.0.136 20121102 Description: A denial of service issue exists in the cgiserver.cgi session creation functionality. This can be triggered by a specially-crafted HTTP request, preventing users from logging in. An...

The vulnerability of NETGEAR’s Wi-Fi routers, namely RBK40, RBR40, and RBS40, stems from improper handling of the cryptographic generation process. This allows attackers to execute a Server Side Include Injection (SSI) attack.

The vulnerability of the built-in Wi-Fi router software from NETGEAR, namely RBK40, RBR40, and RBS40, is related to incorrect code generation. Exploiting this vulnerability could allow an attacker to execute a Server Side Include Injection SSI attack...

PT-2022-15586 · Apple +8 · Ipados +13

Name of the Vulnerable Software and Affected Versions: macOS Monterey versions prior to 12.3 Safari versions prior to 15.4 watchOS versions prior to 8.5 iOS versions prior to 15.4 iPadOS versions prior to 15.4 tvOS versions prior to 15.4 Description: A logic issue was addressed with improved stat...

Remote Code Execution (RCE)

vim is vulnerable to remote code execution. The vulnerability exists due to a use-after-free allowing an attacker to execute malicious code in the system...

PT-2022-2049 · Microsoft · Hevc Video Extensions

Name of the Vulnerable Software and Affected Versions: HEVC Video Extensions affected versions not specified Description: The issue is related to incorrect code generation management in the HEVC Video Extension codec. Exploitation of this issue may allow a remote attacker to execute arbitrary cod...

GHSA-44GV-FGCJ-W546 Missing Authorization in DayByDay CRM

In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account employee type user, can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the...

Cross-site Scripting (XSS)

org.apache.portals.pluto.demo:v3-demo-portlet is vulnerable to cross-site scripting XSS. The library does not properly escape the user input parameters in UrlTestPortlet, allowing a remote attacker to inject and execute malicious javascript...