ALPINE-CVE-2022-21427

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: FTS. Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2022-21420

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence...

PT-2022-2419 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.28 and prior Description: The issue exists due to insufficient input validation in the MySQL Server component, specifically in the Server: Replication subsystem. This allows a remote attacker with high privileges and...

ZOHO ManageEngine OpManager SQL注入漏洞

ZOHO ManageEngine OpManager is a comprehensive network monitoring software from ZOHO USA. A SQL injection vulnerability exists in versions prior to ZOHO ManageEngine OpManager 125588 and 125603, which stems from a problem in the inventory reporting module. An attacker could use this vulnerability...

Verizon 4G LTE Network Extender 0.4.038.2131 Weak Credential Algorithm Exploit

Verizon's 4G LTE Network Extender is utilizing a weak default admin password generation algorithm. The password is generated using the last 4 values from device's MAC address which is disclosed on the main webUI login page to an unauthenticated attacker. The values are then concatenated with the...

PT-2022-17926 · Tenda · Tenda M3

Name of the Vulnerable Software and Affected Versions: Tenda M3 version 1.10 V1.0.0.124856 Description: A command injection issue was found in the component "/goform/setFixTools" API endpoint. Recommendations: For version 1.10 V1.0.0.124856, consider restricting access to the "/goform/setFixTools...

PT-2022-18205 · Tenda · Tenda M3

Name of the Vulnerable Software and Affected Versions: Tenda M3 version 1.10 V1.0.0.124856 Description: A command injection issue was found in the /cgi-bin/uploadWeiXinPic component. Recommendations: For Tenda M3 version 1.10 V1.0.0.124856, consider restricting access to the...

PT-2022-18204 · Tenda · Tenda M3

Name of the Vulnerable Software and Affected Versions: Tenda M3 version 1.10 V1.0.0.124856 Description: A command injection issue was found in the component "/goform/delAd" of the affected software. Recommendations: For version 1.10 V1.0.0.124856, consider restricting access to the "/goform/delAd...

PT-2022-2360 · Kingsoft · Kingsoft Wps Office

Name of the Vulnerable Software and Affected Versions: Kingsoft WPS Office versions 11.2.0.10382 and earlier Description: The issue is related to the wpsupdater.exe file in Kingsoft WPS Office, which allows remote code execution by modifying the HKEY CURRENT USER in the registry. This is due to...

PT-2022-17293 · Tenda · Tenda Ac9

Name of the Vulnerable Software and Affected Versions: Tenda AC9 version 15.03.2.21 Description: A stack overflow issue was discovered via the list parameter in the SetIpMacBind function. This issue affects the Tenda AC9 router. Recommendations: For Tenda AC9 version 15.03.2.21, consider disablin...

CVE-2021-45793

Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained...

post-loader 跨站脚本漏洞

post-loader is a Webpack loader for China EGOIST individual developers. It is used to write blog posts in Markdown. A cross-site scripting vulnerability exists in post-loader, which stems from the use of the markdown parser in an insecure manner, so that any javascript code in a markdown input fi...

CVE-2021-46708

The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further...

CVE-2022-25830

Information Exposure vulnerability in Galaxy Watch3 Plugin prior to version 2.2.09.22012751 allows attacker to access password information of connected WiFiAp in the log...

CVE-2021-43956: Javascript Prototype Pollution in the jQuery deserialize library

The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototype pollution vulnerability. Affected versions: version 4.8.9 Fixed versions: 4.8.9...

PT-2022-4777 · Libtiff +9 · Libtiff +9

Name of the Vulnerable Software and Affected Versions: libtiff version 4.3.0 Description: The issue is related to a reachable assertion in tiffcp in libtiff, which allows attackers to cause a denial-of-service via a crafted tiff file. This can be exploited by a remote attacker to disrupt service...

PT-2022-2548 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.16.12 Description: The issue is related to a double free in the rtrs clt dev release function in the Linux kernel, specifically in the drivers/infiniband/ulp/rtrs/rtrs-clt.c file. This could potentially allow ...

PT-2022-13291 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 1.2.11 Description: The issue is related to improper validation of specified quantity in input, which can lead to business logic errors. This could allow an attacker to manipulate the total value and...

PT-2022-7271 · Libde265 +3 · Libde265 +3

Name of the Vulnerable Software and Affected Versions: Libde265 version 1.0.8 Description: The issue is related to a heap-buffer-overflow vulnerability in the put qpel 0 0 fallback 16 function, located in fallback-motion.cc, which is part of the Libde265 video codec implementation. This...

GHSA-M744-2JJ8-VPFV Command injection in git-parse

The "gitDiff" function in Wayfair git-parse =1.0.4 has a command injection vulnerability. Clients of the git-parse library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability...