mojoPortal 路径遍历漏洞

mojoPortal is the United States Joe Audette individual developer of a set of open source , object-oriented Web site architecture WSF and content management system CMS. The system offers event calendars, photo albums, file managers and more. A security vulnerability exists in mojoPortal v2.7.0.0 a...

jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be bypassed in Pipeline: Stage View Plugin

A Cross-site request forgery CSRF vulnerability was found in a Jenkins plugin. This issue may allow an authenticated attacker to access Jenkins builds, bypassing CSRF protections...

Cross site scripting

If an attacker has access to the console for OpenKM and is authenticated, a stored XSS vulnerability is reachable in the document "note" functionality...

CVE-2022-47414

If an attacker has access to the console for OpenKM and is authenticated, a stored XSS vulnerability is reachable in the document "note" functionality...

Rancher Labs Rancher 安全漏洞

Rancher Labs Rancher is a suite of open source, enterprise-grade container management platforms from US-based Rancher Labs. A security vulnerability exists in SUSE Rancher that stems from the presence of an Authorization Default vulnerability that allows authenticated users to create unauthorized...

New High-Severity Vulnerabilities Discovered in Cisco IOx and F5 BIG-IP Products

F5 has warned of a high-severity flaw impacting BIG-IP appliances that could lead to denial-of-service DoS or arbitrary code execution. The issue is rooted in the iControl Simple Object Access Protocol SOAP interface and affects the following versions of BIG-IP - 13.1.5 14.1.4.6 - 14.1.5 15.1.5.1...

CVE-2022-45783

An issue was discovered in dotCMS core 4.x through 22.10.2. An authenticated directory traversal vulnerability in the dotCMS API can lead to Remote Code Execution...

PT-2023-7312 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP versions 13.1.5 through 17.0.0 Description: A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or potentially execute arbitrary code. In appliance mode...

CVE-2022-37718

The management portal component of JetNexus/EdgeNexus ADC 4.2.8 was discovered to contain a command injection vulnerability. This vulnerability allows authenticated attackers to execute arbitrary commands through a specially crafted payload. This vulnerability can also be exploited from an...

CVE-2023-20038

A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local attacker to access a static secret key used to store both local data and credentials for accessing remote systems. This vulnerability is due to a static key value stored in the...

DEBIAN-CVE-2022-47318

ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-46648...

CVE-2022-46372

Alotcer - AR7088H-A firmware version 16.10.3 Command execution Improper validation of unspecified input field may allow Authenticated command execution...

PT-2023-14921 · Alotcer · Alotcer - Ar7088H-A

Name of the Vulnerable Software and Affected Versions: Alotcer - AR7088H-A firmware version 16.10.3 Description: The issue is related to improper validation of an unspecified input field, which may allow authenticated command execution. Recommendations: For Alotcer - AR7088H-A firmware version...

CVE-2017-16322

Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker...

CVE-2017-16288

Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker...

CVE-2022-43392

A buffer overflow vulnerability in the parameter of web server in Zyxel NR7101 firmware prior to V1.15ACCC.3C0, which could allow an authenticated attacker to cause denial-of-service DoS conditions by sending a crafted authorization request...

Zyxel NR7101 安全漏洞

The Zyxel NR7101 is a router from Hopkins Zyxel. A security vulnerability exists in versions prior to Zyxel NR7101 V1.15ACCC.3C0 that stems from a buffer overflow vulnerability in a web server parameter that allows an authenticated attacker to cause a denial of service DoS by sending a specially...

VulnCheck KEV: CVE-2022-4702

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wprfixroyalcompatibility' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to deactivate every plugin...

PT-2023-15157 · Unknown · Spitfire Cms

Name of the Vulnerable Software and Affected Versions: Spitfire CMS version 1.0.475 Description: A PHP Object Injection issue in the unserialize function allows authenticated attackers to execute arbitrary code via sending crafted requests to the web application. Recommendations: For Spitfire CMS...

CVE-2022-43519

Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the Aruba EdgeConnect Enterprise Orchestrator instance. An attacker could exploit these vulnerabilities...