Design/Logic Flaw

In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 e.g., with GCC 3.2.2 and Linux kernel 2.4.20. This can cause execution of bytes located in supposedly non-executable regions of a file...

CVE-2022-25265

In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 e.g., with GCC 3.2.2 and Linux kernel 2.4.20. This can cause execution of bytes located in supposedly non-executable regions of a file...

CVE-2022-25265

In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 e.g., with GCC 3.2.2 and Linux kernel 2.4.20. This can cause execution of bytes located in supposedly non-executable regions of a file...

CVE-2021-3557

A flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and with the created ServiceAccount argocd-argocd-server, the unprivileged user is able to read all resources of the cluster including all secrets which might enable privilege escalations. The highest...

GHSA-8WRG-M8VM-5FVJ Authentication Bypass by Primary Weakness in github.com/kongchuanhujiao/server

Impact Authentication Bypass by Primary Weakness CWE-305 Commit: https://github.com/kongchuanhujiao/server/commit/9a125624f219e496bdf4b07b404816d5a309bdc1 ALL Users is impacted. Patches Yes, PLEASE UPGRADE TO v1.3.21-beta.d0ffc0a6...

Authentication Bypass by Primary Weakness in github.com/kongchuanhujiao/server

Impact Authentication Bypass by Primary Weakness CWE-305 Commit: https://github.com/kongchuanhujiao/server/commit/9a125624f219e496bdf4b07b404816d5a309bdc1 ALL Users is impacted. Patches Yes, PLEASE UPGRADE TO v1.3.21-beta.d0ffc0a6...

Remote Code Execution (RCE)

cassandra-all is vulnerable to remote code execution. When enableuserdefinedfunctions, enablescripteduserdefinedfunctions, and enablescripteduserdefinedfunctions are set, an attacker can inject and execute malicious code on the host through the scripted UDFs...

CVE-2021-22798

A CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause Sensitive data such as login credentials being exposed when a Network is sniffed. Affected Product: Conext� ComBox All Versions...

PT-2022-9276 · Unknown · Conext Combox

Name of the Vulnerable Software and Affected Versions: Conext ComBox All Versions Description: A vulnerability exists that could cause sensitive data, such as login credentials, to be exposed when a network is sniffed. This issue could lead to the exposure of sensitive information. Recommendation...

CVE-2022-0555

Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions...

PT-2022-13257 · Subiquity · Subiquity

Name of the Vulnerable Software and Affected Versions: Subiquity affected versions not specified Description: The issue concerns Subiquity showing guided storage passphrases in plaintext with read-all permissions. Recommendations: At the moment, there is no information about a newer version that...

UBUNTU-CVE-2022-0555

Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions...

CVE-2022-24319

A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA web server are intercepted. Affected Product: ClearSCADA All Versions, EcoStruxure Geo SCADA Expert 2019 All Versions, EcoStruxure Geo...

CVE-2022-24321

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause Denial of Service against the Geo SCADA server when receiving a malformed HTTP request. Affected Product: ClearSCADA All Versions, EcoStruxure Geo SCADA Expert 2019 All Versions, EcoStruxure Geo...

PT-2022-15935 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase version 1.6.1 Description: The issue allows an authenticated user to gain unauthorized access to all user information and change the administrator password. Recommendations: For DataEase version 1.6.1, at the moment, there is no...

CVE-2022-0148

The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on the my-sticky-elements-leads admin page...

CVE-2021-24928

The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the saveallorder AJAX action, nor validation and escaping when inserting user data in SQL statement, leading to an SQL injection, and allowing any authenticated user, such as subscriber, to...

CVE-2022-0148 All-in-one Floating Contact Form < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)

The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on the my-sticky-elements-leads admin page...

Z-Wave 安全特征问题漏洞

Z-Wave is a wireless communication protocol used primarily for home automation. It is a mesh network that uses low power consumption radio waves to communicate from device to device to wirelessly control appliances and other devices in the home, such as controlling lighting, security systems,...

brookemeyerphotography.com Cross Site Scripting vulnerability OBB-2349546

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...