CVE-2022-33698

Exposure of Sensitive Information in Telecom application prior to SMR Jul-2022 Release 1 allows local attackers to access ICCID via log...

CVE-2022-33699

Exposure of Sensitive Information in getDsaSimImsi in TelephonyUI prior to SMR Jul-2022 Release 1 allows local attacker to access imsi via log...

Input validation

Improper input validation in Contacts Storage prior to SMR Jul-2022 Release 1 allows attacker to access arbitrary file...

CVE-2015-1784

In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security measures preventing unwanted HTTP requests...

Code injection

In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security measures preventing unwanted HTTP requests...

CVE-2022-34151

Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac...

Jenkins Failed Job Deactivator Plugin授权问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. jenkins Plugin is an application. jenkins Failed Job Deactivator Plugin...

IBM Spectrum Protect Plus Container Backup and Restore权限提升漏洞

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM Corporation in the United States. The platform provides enterprises with a single point of control and management, and supports backup and recovery for virtual, physical and cloud environments of all sizes. IBM Spectrum...

The vulnerability of Trendnet TEW-831DR router microprogramming software, related to the use of a rigidly encrypted cryptographic key, allows a hacker to obtain the encryption key.

The vulnerability of Trendnet TEW-831DR router microprogramming software is related to the use of a strictly encrypted cryptographic key. Exploiting this vulnerability can allow an attacker operating remotely to obtain the encryption key...

CVE-2022-31095 Exposure of Sensitive Information in discourse-chat

discourse-chat is a chat plugin for the Discourse application. Versions prior to 0.4 are vulnerable to an exposure of sensitive information, where an attacker who knows the message ID for a channel they do not have access to can view that message using the chat message lookup endpoint, primarily...

CVE-2021-40510

XML eXternal Entity XXE in OBDA systems’ Mastro 1.0 allows remote attackers to read system files via custom DTDs...

The vulnerability of the Azure Site Recovery recovery tool lies in its ability to disclose information, allowing an intruder to gain unauthorized access to protected data.

The vulnerability of the Azure Site Recovery recovery mechanism is related to the exposure of information. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

CVE-2022-33739

CA Clarity 15.8 and below and 15.9.0 contain an insecure XML parsing vulnerability that could allow a remote attacker to potentially view the contents of any file on the system...

Sql injection

The attacker could get access to the database. The SQL injection is in the username parameter at the login panel: username: admin'--...

PT-2022-6745 · Gpgme +11 · Gpgme +11

Name of the Vulnerable Software and Affected Versions: GnuPG versions prior to 2.3.7 Description: The issue is related to insufficient neutralization of special elements in a request, allowing a remote attacker to access and compromise confidential data. In unusual situations where an attacker...

OESA-2022-1696 openjdk-11 security update

The OpenJDK runtime environment. Security Fixes: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and...

Design/Logic Flaw

BigBlueButton is an open source web conferencing system. Starting with version 2.2 and prior to versions 2.3.9 and 2.4-beta-1, an attacker can circumvent access controls to obtain the content of public chat messages from different meetings on the server. The attacker must be a participant in a...

Improper Validation

chromium is vulnerable to improper validation. The vulnerability exists because of insufficient validation of untrusted input in Data Transfer which allows an attacker to gain access to the system...

Directory Traversal

github.com/gphper/ginadmin is vulnerable to directory traversal. The vulnerability exists in the View function in adminSystemController.go due to lack of sanitization in path value which allows an attacker to gain access outside of the intended directory...

Microsoft Internet Explorer Privilege Escalation Vulnerability

A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information...