Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google, Inc. Google Android has an information disclosure vulnerability that originates in gallery3d and photos, which could bypass licensing due to agent confusion and could be exploited by attackers to cause local information...

CVE-2022-26866

Dell PowerStore Versions before v2.1.1.0. contains a Stored Cross-Site Scripting vulnerability. A high privileged network attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user...

The vulnerability of the func2.php function in the web application for managing a medical institution, the PHPGurukul Hospital Management System, allows a perpetrator to disclose protected information.

The vulnerability of the func2.php function in the web application of the PHPGurukul Hospital Management System is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to disclose the protected information remotely...

The vulnerability of the Linux operating system’s kernel, which allows a hacker to disclose protected information

The vulnerability of the Linux operating system’s kernel is related to a flaw in the Cortex and Neoverse processors from Arm. Exploiting this vulnerability can allow attackers to disclose sensitive information by circumventing the eIBRS and CSV2 protection mechanisms...

Nginx Plus > R13 Data Disclosure Vulnerability

According to its self reported version, the installed version of Nginx Plus is prior to R13 built on Open Source version 1.13.4. It is, therefore, affected by an integer overflow vulnerability in the range filter module. An unauthenticated, remote attacker can exploit this, via a specially crafte...

The vulnerability of the Android operating system’s kernel, which allows a hacker to disclose protected information

The vulnerability of the Android operating system’s kernel is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability can allow a hacker to execute arbitrary code...

CVE-2022-20806

Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about...

CVE-2022-20807

Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about...

Multiple vulnerabilities in Fuji Electric V-SFT

Overview Multiple vulnerabilities listed below exist in the simulator module contained in the graphic editor "V-SFT" provided by FUJI ELECTRIC CO., LTD. Out-of-bounds Write CWE-787 - CVE-2022-30538 Out-of-bounds Read CWE-125 - CVE-2022-30546 Heap-based Buffer Overflow CWE-122 - CVE-2022-26302 Use...

CVE-2022-22662

A cookie management issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Big Sur 11.6.5. Processing maliciously crafted web content may disclose sensitive user information...

UBUNTU-CVE-2022-22662

A cookie management issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Big Sur 11.6.5. Processing maliciously crafted web content may disclose sensitive user information...

CVE-2022-20809

Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about...

The vulnerability of the dnsproxy package from the ConnectMan controller allows a hacker to access confidential information or cause service failures.

The vulnerability of the dnsproxy package of the Connman connection manager is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to access confidential information or cause service failures...

多款DELL产品跨站脚本漏洞

DELL UnityVSA and DELL Unity are both products of Dell DELL Inc.UnityVSA is a set of virtual Unity storage environments.DELL Unity is a set of virtual Unity storage environments. A security vulnerability exists in Dell Unity, Dell UnityVSA, and Dell UnityXT versions prior to 5.2.0.0.5.173, which...

Security Bulletin: IBM MQ trace can inadvertently trace sensitive data (CVE-2022-22325)

Summary An issue was identified with IBM MQ tracing logic used by queue managers and native C-based MQ clients that meant sensitive data could be captured while IBM MQ trace was running. This data would be stored in plaintext within the IBM MQ trace files. Vulnerability Details CVEID:...

USN-5435-1 thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, bypass permission prompts, obtain sensitive information, bypass security...

GHSA-WGPR-9675-8R67 Magento discloses sensitive information via the Multishipping Module

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability in the Multishipping Module. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure...

Magento discloses sensitive information via the Multishipping Module

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability in the Multishipping Module. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure...

GHSA-87X7-PWRX-JCH7 Liferay Portal and Liferay DXP Reveals Data via Overly Verbose Error Messages

The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused...

Square OkHttp can accept the wrong certificate

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...