The vulnerability of the ParametersInterceptor class implementation in the Apache Struts software platform allows attackers to compromise the integrity of the protected information.

The vulnerability of the ParametersInterceptor class implementation in the Apache Struts software platform is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to manipulate the integrity of protected information by using a class parameter passed t...

PT-2022-26319 · Unknown · Simple Cold Storage Management System

Name of the Vulnerable Software and Affected Versions: Simple Cold Storage Management System version 1.0 Description: The issue allows for SQL Injection via the "/csms/admin/?page=user/manage user&id=" API endpoint, specifically targeting the id variable. This could potentially lead to unauthoriz...

Vulnerabilities fixed in Trend Micro Apex One

Vulnerabilities have been fixed in Trend Micro Apex One. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS. Manipulation of data Increased user privileges To exploit the vulnerabilities, a...

CVE-2022-26236

CVE-2022-26236 affects Beckman Coulter Remisol Advance, specifically the Norman/Normand Remisol Advance Launcher component in versions up to 2.0.12.1. The issue arises from default privileges of the running launcher service, which allow non-privileged users to overwrite and manipulate executables...

Security Bulletin: IBM Security Identity Governance and Intelligence is vulnerable to unauthenticated access resulting in various threats (CVE-2022-21496)

Summary IBM Security Identity Governance and Intelligence is vulnerable to sensitive information access, data manipulation and denial of service by an unauthenticated attacker due to a vulnerability in Java SE related to the JNDI component CVE-2022-21496. The fix includes upgrading Java SE and...

Vulnerability fixed in Expat

A vulnerability has been fixed in Expat. A malicious person can cause a use-after-free in libexpat via the doContent function in xmlparse.c. Misuse of the vulnerability potentially results in the following categories of damage: Denial-of-Service DoS. Manipulation of data Remote code execution Use...

PT-2022-25636 · Unknown · Dairy Farm Shop Management System

Name of the Vulnerable Software and Affected Versions: Dairy Farm Shop Management System version 1.0 Description: The issue is related to SQL Injection, which can be exploited via the bwdate-report-ds.php file. This allows for potential unauthorized access or manipulation of data. Recommendations...

Vulnerabilities fixed in Cisco products

Vulnerabilities have been fixed in several Cisco products. The vulnerabilities allow a malicious party to conduct attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Circumvention of security measure Remote code execution...

Vulnerabilities fixed in Node.js

Vulnerabilities have been fixed in Node.js. The vulnerabilities allow a malicious person to perform attacks that lead to the following categories of damage: Manipulation of data Spoofing Access to sensitive data Node.js developers have released updates to address the vulnerabilities. More...

Feehi CMS 2.1.1 - Remote Code Execution (Authenticated)

Exploit Title: Feehi CMS 2.1.1 - Remote Code Execution RCE Authenticated Date: 22-08-2022 Exploit Author: yuyudhn Vendor Homepage: https://feehi.com/ Software Link: https://github.com/liufee/cms Version: 2.1.1 REQUIRED Tested on: Linux, Docker CVE : CVE-2022-34140 Proof of Concept: 1. Login using...

Vulnerabilities fixed in Linux Kernel

Vulnerabilities have been fixed in the Linux Kernel. The vulnerabilities allow a malicious person to carry out attacks execute attacks that lead to the following categories of damage: Denial-of-Service DoS Manipulation of data Remote code execution User rights Access to system data Increased user...

mysql: Server: DML unspecified vulnerability (CPU Oct 2021)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...

mysql: Server: DML unspecified vulnerability (CPU Oct 2021)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of...

Vulnerabilities fixed in Zoom

Vulnerabilities have been fixed in Zoom. The vulnerabilities allow a malicious person to carry out attacks that result in the following categories of damage: Manipulation of data Circumvention of security measure Accessing sensitive data The vulnerabilities with characteristics CVE-2022-28758 and...

Ruby on Rails: ActionView sanitize helper bypass leading to XSS using SVG tag.

An HTML sanitization bypass vulnerability was discovered in the ActionView sanitize helper. This allowed an attacker to bypass sanitization and execute cross-site scripting XSS attacks by using the use tag of the SVG element. By embedding a base64 encoded SVG with malicious code, an attacker coul...

Rails 代码问题漏洞

Rails is a set of open source web application frameworks based on the Ruby language by the American Rails team. Rails has a security vulnerability that stems from the fact that when serialized columns using YAML the default are deserialized, Rails uses YAML.unsafeload to transform the YAML data...

Vulnerabilities fixed in GitLab CE and EE

Vulnerabilities have been fixed in GitLab Community Edition and Enterprise Edition. The vulnerabilities allow a malicious person to able to perform attacks that result in the following categories of damage: Cross-Site Scripting XSS Denial-of-Service DoS. Manipulation of data Bypassing...

CVE-2021-42627

The WAN configuration page "wan.htm" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without authentication which can lead to disclose the information about WAN settings and also leverage attacker to modify the data fields of page...

PT-2022-18697 · Emerson Electric · Proficy Machine Edition

Name of the Vulnerable Software and Affected Versions: Emerson Electric's Proficy Machine Edition versions 9.00 and prior Description: The issue concerns a lack of integrity check support, allowing for potential data manipulation. Specifically, after establishing a connection using the SRTP...

PT-2022-21328 · Cybozu · Cybozu Office

Name of the Vulnerable Software and Affected Versions: Cybozu Office versions 10.0.0 through 10.8.5 Description: The issue allows a remote attacker to obtain and/or alter the data of the product via unspecified vectors. This is due to an HTTP header injection vulnerability. Recommendations: For...