ByteDance Lemon8 安全漏洞

ByteDance Lemon8 is a lifestyle messaging application for young people from China's ByteDance. A security vulnerability exists in ByteDance Lemon8 versions prior to 3.3.5. The vulnerability stems from the fact that it does not have reasonably restricted access privileges, which could allow a remo...

PT-2022-22456 · Sourcecodester · Sourcecodester Human Resource Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Human Resource Management System version 1.0 Description: A critical issue was found in the Admin Panel component, specifically in the file employeeadd.php, leading to improper access controls. This issue can be exploited...

CVE-2022-3496

CVE-2022-3496 concerns a vulnerability in SourceCodester Human Resource Management System 1.0, affecting the Admin Panel’s file employeeadd.php . The issue is described as an improper access control flaw that can be exploited remotely, with the attack vector labeled as network and low privileges ...

PT-2022-5495 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows Group Policy service, allowing a remote attacker to elevate their privileges. Recommendations: At the moment, there i...

PT-2022-5401 · Microsoft · Windows Workstation Service +1

Name of the Vulnerable Software and Affected Versions: Windows Workstation Service affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows Workstation Service, allowing a remote attacker to elevate their privileges. This can affect the...

Johnson Controls Metasys ADX Server Licensing Issue Vulnerability

Johnson Controls Metasys ADX Server is a data server from Johnson Controls, Inc. An authorization issue vulnerability exists in Johnson Controls Metasys ADX Server version 12.0, which stems from improper access controls in the application and could be exploited by an attacker to cause an AD user ...

PT-2022-5660 · Microsoft · Windows Mixed Reality Developer Tools +1

Name of the Vulnerable Software and Affected Versions: Windows Mixed Reality Developer Tools affected versions not specified Description: The issue is related to insufficient access controls in the system, allowing an attacker to gain unauthorized access to protected information. This can be...

PT-2022-5517 · Microsoft · Windows Dwm Core Library +1

Name of the Vulnerable Software and Affected Versions: Windows DWM Core Library affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows DWM Core Library, which can be exploited to elevate privileges. This allows an attacker to affect th...

CVE-2022-20775

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted...

CVE-2022-20818

Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit these vulnerabilities by running a...

CVE-2022-20818 Cisco SD-WAN Software Privilege Escalation Vulnerabilities

Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit these vulnerabilities by running a...

CVE-2022-20818 Cisco SD-WAN Software Privilege Escalation Vulnerabilities

Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit these vulnerabilities by running a...

CVE-2022-20775 Cisco SD-WAN Software Privilege Escalation Vulnerability

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted...

CVE-2022-20775 Cisco SD-WAN Software Privilege Escalation Vulnerability

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted...

Cisco SD-WAN Software Privilege Escalation Vulnerabilities (cisco-sa-sd-wan-priv-E6e8tEdF)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by multiple vulnerabilities. - Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access...

Squid 安全漏洞

Squid is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. Squid has a security vulnerability. An attacker can exploit this vulnerability to read sensitive information by...

Consul Service Mesh Intention Bypass with Malicious Certificate Signing Request

Summary A vulnerability was identified in Consul and Consul Enterprise “Consul” such that a specially crafted CSR sent directly to Consul’s internal server agent RPC endpoint can include multiple SAN URI values with additional service names. This vulnerability, CVE-2022-40716, was fixed in Consul...

PT-2022-5825 · Microsoft · Azure Arc +1

Name of the Vulnerable Software and Affected Versions: Azure Guest Configuration and Azure Arc-enabled servers affected versions not specified Description: The issue is related to insufficient access controls in the Azure Guest Configuration component, which is part of the Azure Policy service an...

PT-2022-19201 · Unknown · Aenrich Ehrd Learning Management Key Performance Indicator System

Name of the Vulnerable Software and Affected Versions: aEnrich eHRD Learning Management Key Performance Indicator System version 5+ Description: The issue concerns the exposure of sensitive information to unauthorized actors. Recommendations: For version 5+, consider restricting access to sensiti...

CVE-2022-1525

The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 3354 and prior is vulnerable to CWE-602: Client-Side Enforcement of Server-Side Security, which could allow attackers to bypass web access controls by inspecting and modifying the source code of password protected web elements...