GHSA-Q7QQ-9GX2-GGXV phpxmlrpc vulnerable to argument injection

phpxmlrpc vulnerable to argument injection via local file access in Client:send via manipulation of $protocol argument...

PT-2022-28271 · Phpxmlrpc · Phpxmlrpc

Name of the Vulnerable Software and Affected Versions: phpxmlrpc affected versions not specified Description: The issue concerns argument injection via local file access in the Client:send function. This is achieved through manipulation of the $protocol argument. Recommendations: At the moment,...

CVE-2022-4257

A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be...

PT-2022-26501 · Unknown · C-Data Web Management System

Name of the Vulnerable Software and Affected Versions: C-DATA Web Management System affected versions not specified Description: A critical issue affects the C-DATA Web Management System, specifically the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the...

CVE-2022-4257

C-DATA Web Management System contains a vulnerability in the GET Parameter Handler’s cgi-bin/jumpto.php where manipulating the hostname argument leads to argument injection. The issue can be exploited remotely and an exploit has been disclosed publicly. Affected component/file: cgi-bin/jumpto.php...

CVE-2022-4257

A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be...

CVE-2022-4232

A vulnerability, which was classified as critical, was found in SourceCodester Event Registration System 1.0. Affected is an unknown function. The manipulation of the argument cmd leads to unrestricted upload. It is possible to launch the attack remotely. VDB-214590 is the identifier assigned to...

PT-2022-26365 · Sourcecodester · Sourcecodester Event Registration System

Name of the Vulnerable Software and Affected Versions: SourceCodester Event Registration System version 1.0 Description: A critical issue was found, allowing for unrestricted upload through the manipulation of the cmd argument. This can be exploited remotely. Recommendations: For version 1.0,...

Password exposure in H2 Database

The web-based admin console in H2 Database Engine through 2.1.214 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user or an attacker that has obtained local access through...

UBUNTU-CVE-2022-45868

DISPUTED The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user or an attacker that has obtained local access...

CVE-2022-23740 Improper Neutralization of Argument Delimiters in a Command in GitHub Enterprise Server leading to Remote Code Execution

CRITICAL: An improper neutralization of argument delimiters in a command vulnerability was identified in GitHub Enterprise Server that enabled remote code execution. To exploit this vulnerability, an attacker would need permission to create and build GitHub Pages using GitHub Actions. This...

The vulnerability of the iControl REST interface for access control and remote authentication in BIG-IP allows a perpetrator to circumvent existing security restrictions.

The vulnerability of the iControl REST interface for access control and remote authentication in BIG-IP involves insufficient checking of arguments passed in commands. Exploiting this vulnerability could allow a malicious actor to circumvent existing security restrictions remotely...

PT-2022-16243 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server version 3.7.0 Description: An improper neutralization of argument delimiters in a command vulnerability was identified in GitHub Enterprise Server that enabled remote code execution. To exploit this vulnerability, an...

CVE-2021-24649

The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpufencryption. This could allow an attacker having access to the AUTHKEY and AUTHSALT constant via...

SUSE-SU-2022:4100-1 Security update for the Linux Kernel (Live Patch 20 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-1503005976 fixes several issues. The following security issues were fixed: - CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUTVSCREENINFO bnc1201635. - CVE-2022-2588: Fixed use-after-free in clsroute bsc1202096. - CVE-2022-42703: Fixed...

OESA-2022-2105 xfce4-settings security update

This package includes the settings manager applications for the Xfce desktop. Security Fixes: In Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection vulnerability in xfce4-mime-helper.CVE-2022-45062...

ruby-git: package vulnerable to Command Injection via git argument injection

A flaw was found in ruby-git, where the package is vulnerable to command injection via the git argument. This flaw allows an attacker to set additional flags, which leads to performing command injections...

kernel: dm thin: fix use-after-free crash in dm_sm_register_threshold_callback

In the Linux kernel, the following vulnerability has been resolved: dm thin: fix use-after-free crash in dmsmregisterthresholdcallback Fault inject on pool metadata device reports: BUG: KASAN: use-after-free in dmpoolregistermetadatathreshold+0x40/0x80 Read of size 8 at addr ffff8881b9d50068 by...

kernel: exec: Force single empty string when argv is empty

In the Linux kernel, the following vulnerability has been resolved: exec: Force single empty string when argv is empty Quoting1 Ariadne Conill: "In several other operating systems, it is a hard requirement that the second argument to execve2 be the name of a program, thus prohibiting a scenario...

PT-2022-35172 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue is related to the uvc register video function in the Linux Kernel. It involves a potential problem with the argument to sizeof. The actual impact and attack plausibility have not ye...