PT-2023-5862 · Git · Git For Windows

Name of the Vulnerable Software and Affected Versions: Git for Windows versions prior to 2.40.1 Description: The issue is related to an Uncontrolled Search Path Element vulnerability. It affects users of Git CMD who start the command in an untrusted directory, allowing maliciously-placed doskey.e...

artemis-commons: Apache ActiveMQ Artemis DoS

In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability DoS through uncontrolled resource consumption of memory...

PT-2022-18508 · Sick · Sick Sim1004

Name of the Vulnerable Software and Affected Versions: SICK SIM1004 Partnumber 1098148 versions prior to 2.0.0 Description: A password recovery issue allows an unprivileged remote attacker to invoke the password recovery mechanism method, gaining access to the user level defined as...

PYSEC-2022-42983

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API...

ALPINE-CVE-2022-39244

PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced by a buffer overflow vulnerability. Users connecting to untrusted clients are at risk. This issue has been...

PYSEC-2022-285

Cross-Site Request Forgery CSRF in GitHub repository ikus060/rdiffweb prior to 2.4.6...

CVE-2022-2177

Kayrasoft product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2...

PT-2022-22313 · Zyxel · Zyxel Gs1900

Name of the Vulnerable Software and Affected Versions: Zyxel GS1900 series firmware versions prior to V2.70 Description: An insufficient entropy issue, caused by the improper use of randomness sources with low entropy for RSA key pair generation, affects the web administration interface. This cou...

WordPress plugin Affiliates Manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

MB CONNECT LINE mymbCONNECT24 安全漏洞

MB CONNECT LINE mymbCONNECT24 is an in-house remote maintenance solution for virtual environments from MB CONNECT LINE, Germany. A security vulnerability exists in MB CONNECT LINE mymbCONNECT24, mbCONNECT24, Helmholz myREX24, and myREX24.virtual v2.11.2 and prior versions, which originates from a...

tinygltf 命令注入漏洞

tinygltf is a header-only C++ miniature glTF library loader/saver by the Japanese individual developer Syoyo Fujita. A security vulnerability exists in tinygltf versions prior to 2.6.0, which stems from the C library function wordexp performs file path expansion on untrusted paths provided by the...

PT-2022-7691 · Tinygltf +2 · Tinygltf +2

Name of the Vulnerable Software and Affected Versions: tinygltf versions prior to 2.6.0 Description: The tinygltf library has an issue related to the use of the C library function wordexp for file path expansion on untrusted paths from input files. This allows for command injection using backtick...

AZL-10714 CVE-2022-38533 affecting package binutils for versions less than 2.37-4

In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfdgetl32 when called from the stripmain function in strip-new via a crafted file...

Vite 路径遍历漏洞

Vite is a new front-end build tool open-sourced by Vite. A security vulnerability exists in versions prior to Vite v2.9.13 that stems from a vulnerability that allows an attacker to perform directory traversal of a victim's service via a crafted URL...

CVE-2022-28626

A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 iLO 5 firmware versions: Prior to 2.71. A highly privileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and...

CVE-2022-28627

A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 iLO 5 firmware versions: Prior to 2.71. An unprivileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and availability...

Hewlett Packard Enterprise Integrated Lights-Out 5 安全漏洞

Hewlett Packard Enterprise Integrated Lights-Out 5 iLO 5 is a remote control solution from Hewlett Packard Enterprise. The solution enables remote monitoring and operation of IT assets such as servers. A security vulnerability exists in Hewlett Packard Enterprise Integrated Lights-Out 5 iLO 5...

CVE-2022-2400

External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0...

CVE-2022-1910

The Shortcodes and extra features for Phlox WordPress plugin before 2.9.8 does not sanitise and escape a parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting...

CVE-2022-30229

A vulnerability has been identified in SICAM GridEdge Classic All versions V2.6.6. The affected application does not require authenticated access for privileged functions. This could allow an unauthenticated attacker to change data of a user, such as credentials, in case that user's id is known...