CVE-2022-32560

An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings...

CVE-2022-1611

The Bulk Page Creator WordPress plugin before 1.1.4 does not protect its page creation functionalities with nonce checks, which makes them vulnerable to CSRF...

ntfs-3g: Heap buffer overflow triggered by a specially crafted Unicode string

The ntfs3g package is susceptible to a heap overflow on crafted unicode input. When processing NTFS unicode input, proper bounds checking was not enforced leading to this software flaw. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability...

CVE-2022-28165

A vulnerability in the role-based access control RBAC functionality of the Brocade SANNav before 2.2.0 could allow an authenticated, remote attacker to access resources that they should not be able to access and perform actions that they should not be able to perform. The vulnerability exists...

PT-2022-6789 · Click5 · Sitemap

Name of the Vulnerable Software and Affected Versions: Sitemap by click5 WordPress plugin versions prior to 1.0.36 Description: The issue is related to the lack of authorization and CSRF checks when updating options via a REST endpoint, and the failure to ensure that the option to be updated...

CVE-2022-0141

The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make a logged in admin or editor delete and restore arbitrary form entries via CSRF attacks...

多款 MediaTek 产品缓冲区错误漏洞

MediaTek chips are a variety of chips from MediaTek, a division of China's MediaTek Mediatek. A security vulnerability exists in several MediaTek products, which stems from a lack of boundary checking in atf spm, which may result in out-of-bounds writes...

Google Android 安全漏洞

Google Android is a Linux-based open-source operating system from the U.S. Google Android has an elevation of privilege vulnerability that stems from a lack of privilege checks in WindowManager, which could be exploited by attackers to gain elevated privileges...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google, Inc. Google Android is vulnerable to an information disclosure vulnerability that stems from a lack of permission checking in Framework. An attacker could use this vulnerability to obtain sensitive information...

Jenkins Bitbucket Server Integration Plugin 权限许可和访问控制问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application software.Jenkins Bitbucket Server...

CSRF vulnerability and missing permission checks in proxmox

proxmox 0.7.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to: connect to an attacker-specified host using attacker-specified username and password, performing a connection test, disable SSL/TLS validation for the...

Jenkins Job and Node ownership Plugin 访问控制错误漏洞

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Job and Node ownership Plugin 0.13.0 and earlier versions are vulnerable to an authorization issue that stems from...

The vulnerability of Adobe Medium’s 3D modeling software lies in the copying of buffers without checking the size of the input data. This allows a malicious actor to execute arbitrary code.

The vulnerability of Adobe Medium’s 3D modeling software lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2022-26104

SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messages, resulting for an unauthorized user to alter the maintenance system message...

Maddy Mail Server 安全漏洞

Maddy Mail Server is a composable all-in-one mail server from the Russian individual developer Max Mazurov. A security vulnerability exists in maddy Mail Server versions prior to 0.5.4, which stems from not implementing password expiration or account expiration checks when using PAM for...

CVE-2021-24971

The WP Responsive Menu WordPress plugin before 3.1.7.1 does not have capability and CSRF checks in the wprliveupdate AJAX action, as well as do not sanitise and escape some of the data submitted. As a result, any authenticated, such as subscriber could update the plugin's settings and perform...

CVE-2021-46601

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

CVE-2022-25193

Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

Apache Cayenne 代码问题漏洞

Apache Cayenne is the United States Apache Apache Foundation of an open source persistence framework licensed under the Apache license . Used to provide object-relational mapping and teleprocessing services. An input validation error vulnerability exists in Apache Cayenne because the product does...

CVE-2022-22535

SAP ERP HCM Portugal - versions 600, 604, 608, does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area. Since the affected report only reads the payroll information, the attacker can neither modify any information nor cause...