CVE-2022-31680

The vCenter Server contains an unsafe deserialisation vulnerability in the PSC Platform services controller. A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server...

CVE-2022-2975

A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modify accounts leading to execution of arbitrary code as the root user. This issue affects Application Enablement Services versions 8.0.0.0...

PT-2022-6310 · Ibm · Ibm Cloud Pak For Multicloud Management Monitoring

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak for Multicloud Management Monitoring versions 2.0 through 2.3 Description: The issue is related to incorrect restriction of a directory path with limited access. Exploitation of this issue may allow a remote attacker to elevate...

PT-2022-5017 · Vmware · Vcenter Server +1

Name of the Vulnerable Software and Affected Versions: vCenter Server affected versions not specified Description: The vCenter Server contains an unsafe deserialization vulnerability in the PSC Platform services controller. A malicious actor with admin access on the vCenter server may exploit thi...

CVE-2022-2628

The DSGVO All in one for WP WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-34428

Dell Hybrid Client prior to version 1.8 contains a Regular Expression Denial of Service Vulnerability in the UI. An adversary with WMS group admin access could potentially exploit this vulnerability, leading to temporary denial-of-service...

DRUPAL-CORE-2022-016

Drupal uses the Twig third-party library for content templating and sanitization. Twig has released a security update that affects Drupal. Twig has rated the vulnerability as high severity. Drupal core's code extending Twig has also been updated to mitigate a related vulnerability. Multiple...

CVE-2022-3119

The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they...

CVE-2022-2926

The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as admin to list and read arbitrary files and folders outside of the blog directory...

Cross site request forgery (csrf)

The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they...

CVE-2022-2926 Download Manager < 3.2.55 - Admin+ Arbitrary File/Folder Access via Path Traversal

The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as admin to list and read arbitrary files and folders outside of the blog directory...

CVE-2022-40672

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in CPO Shortcodes plugin = 1.5.0 at WordPress...

We’re Open! < 1.42 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Put the following payload in the Settings We're Op...

PT-2022-18215

Name of the Vulnerable Software and Affected Versions Float to Top Button WordPress plugin versions 2.3.6 and earlier Description The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...

PT-2022-13988 · WordPress · Wordpress Ping Optimizer

Name of the Vulnerable Software and Affected Versions: WordPress Ping Optimizer versions prior to 2.35.1.3.0 Description: The issue is related to the lack of a CSRF check when updating settings in the WordPress Ping Optimizer plugin. This could allow attackers to make a logged-in admin change...

Buffer overflow

Improper Input Validation vulnerability in Hitachi Energy MicroSCADA X SYS600 while reading a specific configuration file causes a buffer-overflow that causes a failure to start the SYS600. The configuration file can only be accessed by an administrator access. This issue affects: Hitachi Energy...

CVE-2022-39801

SAP GRC Access control Emergency Access Management allows an authenticated attacker to access a Firefighter session even after it is closed in Firefighter Logon Pad. This attack can be launched only within the firewall. On successful exploitation the attacker can gain access to admin session and...

PT-2022-24807 · Onedev · Onedev

Name of the Vulnerable Software and Affected Versions: Onedev versions prior to 7.3.0 Description: Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. During CI/CD builds, it is possible to save build artifacts for later retrieval. These artifact files are served by the...

Genymotion Desktop 代码问题漏洞

Genymotion Desktop is an Android emulator from Genymotion. A security vulnerability exists in Genymotion Desktop version 3.2.1, which stems from a missing profapi.dll, and can be exploited by an attacker to use a malicious dll with the same name and gain administrator privileges, as well as execu...

PT-2022-24074 · Unknown · Simple Online Book Store System

Name of the Vulnerable Software and Affected Versions: Simple Online Book Store System version 1.0 Description: The issue concerns Cross Site Scripting XSS in the /admin book.php file, where the Title, Author, and Description parameters are vulnerable. This allows for potential malicious script...