OESA-2022-1753 libsepol security update

libsepol provides an API for the manipulation of SELinux binary policies. It is used by checkpolicy the policy compiler and similar tools, as well as by programs like loadpolicy that need to perform specific transformations on binary policies such as customizing policy boolean settings. Security...

CVE-2022-32074

A stored cross-site scripting XSS vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file...

Enhancesoft osTicket 跨站脚本漏洞

Enhancesoft osTicket is an open source ticketing system from Enhancesoft, Inc. in the United States. A security vulnerability exists in Enhancesoft osTicket, which stems from its component audit/class.audit.php that allows attackers to execute arbitrary web script or HTML via a crafted SVG file...

The vulnerability of the Standard Operation and Monitoring function in distributed control systems such as CENTUM VP and CENTUM VP Entry Class allows attackers to execute arbitrary commands.

The vulnerability of the Standard Operation and Monitoring function in distributed control systems such as CENTUM VP and CENTUM VP Entry Class exists due to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability can allow...

The vulnerability of clients under comprehensive network endpoint protection from Check Point Endpoint Security, which arises from the use of external control for selecting classes, allows attackers to disable the protection of certain network endpoints.

The vulnerability of Check Point Endpoint Security’s comprehensive network endpoint protection lies in the use of externally controlled input data for determining class assignments. Exploiting this vulnerability can allow an attacker to disable the protection for certain network endpoints...

jdbc-postgresql: Unchecked Class Instantiation when providing Plugin Classes

pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based o...

Linux kernel 安全漏洞

ini class to trigger a buffer overflow and gain access to out-of-bounds memory, which can lead to a crash or elevate their privileges to administrator and execute arbitrary commands...

CVE-2022-33108

XPDF v4.04 was discovered to contain a stack overflow vulnerability via the Object::Copy class of object.cc files...

CVE-2022-33108

XPDF v4.04 was discovered to contain a stack overflow vulnerability via the Object::Copy class of object.cc files...

CVE-2022-33108

XPDF v4.04 was discovered to contain a stack overflow vulnerability via the Object::Copy class of object.cc files...

CVE-2022-33108

CVE-2022-33108 affects XPDF 4.04; the vulnerability is a stack overflow in Object::Copy (object.cc). Exploitation details are not described beyond this, but multiple advisories indicate updated packages are required (e.g., XPDF >= 4.05) to fix these issues. Connected sources corroborate the CV...

CVE-2022-33108

XPDF v4.04 was discovered to contain a stack overflow vulnerability via the Object::Copy class of object.cc files...

DEBIAN-CVE-2022-31084

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument. This can lead to cod...

Cross-site Scripting (XSS)

Overview grapesjs is a web builder framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to an improper sanitization of the class name in Selector Manager. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a...

PT-2022-3277 · Unknown · Ldap Account Manager

Name of the Vulnerable Software and Affected Versions: LDAP Account Manager versions prior to 8.0 Description: The issue is related to the instantiation of objects from arbitrary classes in LDAP Account Manager, allowing an attacker to inject the first constructor argument. This can lead to code...

worldclassteachers.co.uk Cross Site Scripting vulnerability OBB-2675836

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

DEBIAN-CVE-2022-2120

OFFIS DCMTK's All versions prior to 3.6.7 service class user SCU is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution...

CVE-2022-2119

OFFIS DCMTK's All versions prior to 3.6.7 service class provider SCP is vulnerable to path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution...

UBUNTU-CVE-2022-2119

OFFIS DCMTK's All versions prior to 3.6.7 service class provider SCP is vulnerable to path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution...

UBUNTU-CVE-2022-2120

OFFIS DCMTK's All versions prior to 3.6.7 service class user SCU is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution...