PT-2022-18246 · Unknown · Express-Fileupload

Name of the Vulnerable Software and Affected Versions: express-fileupload version 1.3.1 Description: An arbitrary file upload vulnerability in the file upload module of express-fileupload allows attackers to execute arbitrary code via a crafted PHP file. The vendor's position is that the observed...

PT-2022-17522 · Autodesk · Autodesk Fbx Review

Name of the Vulnerable Software and Affected Versions: Autodesk FBX Review versions 1.5.2 and prior Description: An Out-Of-Bounds Read issue may lead to code execution or information disclosure through maliciously crafted ActionScript Byte Code ABC files. These ABC files, created by the Flash...

UBUNTU-CVE-2022-24793

PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.12 and prior affects applications that use PJSIP DNS resolution. It doesn't affect PJSIP users who utilize an external resolver. This vulnerability is related to...

CVE-2022-23440

A use of hard-coded cryptographic key vulnerability CWE-321 in the registration mechanism of FortiEDR collectors versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow a local attacker to disable and uninstall the collectors from the end-points within the same deployment...

CVE-2022-23440

A use of hard-coded cryptographic key vulnerability CWE-321 in the registration mechanism of FortiEDR collectors versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow a local attacker to disable and uninstall the collectors from the end-points within the same deployment...

Hardcoded credentials

A use of hard-coded cryptographic key vulnerability CWE-321 in the registration mechanism of FortiEDR collectors versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow a local attacker to disable and uninstall the collectors from the end-points within the same deployment...

CVE-2022-23440

A use of hard-coded cryptographic key vulnerability CWE-321 in the registration mechanism of FortiEDR collectors versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow a local attacker to disable and uninstall the collectors from the end-points within the same deployment...

The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature or via SAX using the XERCES_DISABLE_DTD environment variable.

...

Fortinet FortiEDR 信任管理问题漏洞

Fortinet FortiEDR is a scratch-built endpoint security solution from Fortinet U.S.A. Fortinet FortiEDR is vulnerable to a trust management issue that stems from the use of hard-coded encrypted RSA keys, which can be exploited by local attackers to disable and offload collectors from endpoints in...

PT-2022-2680 · Pjsip +2 · Pjsip +2

Name of the Vulnerable Software and Affected Versions: PJSIP versions 2.12 and prior Description: The issue is related to the implementation of the pjmedia rtcp fb parse rpsi function in the PJSIP multimedia communication library. It is associated with a buffer overflow in memory when processing ...

PT-2022-3642 · Swhkd · Swhkd

Name of the Vulnerable Software and Affected Versions: SWHKD version 1.1.5 Description: The issue is related to unsafe parsing via the -c option, which can lead to an information leak or a denial of service memory exhaustion when attempting to parse large or infinite files, such as block or...

PT-2022-3802 · Swhkd · Swhkd

Name of the Vulnerable Software and Affected Versions: SWHKD version 1.1.5 Description: The issue is related to a lack of proper access control in the SWHKD implementation of the Wayland display server protocol, specifically when handling files with the -c option. This can allow an attacker to...

CVE-2022-27609

Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows does not provide sufficient anti-tampering protection of services by users with Administrator privileges. This could result in a user disabling Forcepoint One Endpoint and the protection offered by it...

Forcepoint One Endpoint安全漏洞

Forcepoint One Endpoint is a data leakage prevention solution from US-based Forcepoint. A security vulnerability exists in Forcepoint One Endpoint for Microsoft Windows, versions prior to 22.01, which stems from an inability to provide adequate service tamper protection for users with administrat...

Command Injection

asciidoctor-include-ext is vulnerable to Command Injection. The library renders user-supplied input in AsciiDoc markup, which allows an attacker to execute arbitrary system commands on the host operating system when the allow-uri-read is disabled...

PT-2022-2537 · D Link · D-Link Dir-882

Name of the Vulnerable Software and Affected Versions: D-link DIR-882 version A1 FW130B06 Description: A command injection issue was found in the /usr/bin/cli endpoint, related to the handling of symbolic links. This could allow a remote attacker to execute arbitrary commands due to inadequate da...

PT-2022-4845 · D Link · D-Link Dir-2150

Name of the Vulnerable Software and Affected Versions: D-Link DIR-2150 version 4.0.1 Description: The issue is related to a stack-based buffer overflow in the anweb service of the D-Link DIR-2150 router. This allows a remote attacker to execute arbitrary code on the affected device. The anweb...

MediaWiki <= 1.39.4 Multiple Vulnerabilities - Linux

MediaWiki is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mediawiki:mediawiki"; ifdescripti...

PT-2022-18876 · Unknown +2 · Antispoof Extension +2

Name of the Vulnerable Software and Affected Versions: Mediawiki versions through 1.37.1 Description: An issue was discovered in the AntiSpoof extension where the check for the override-antispoof permission is incorrect. Recommendations: For versions through 1.37.1, as a temporary workaround,...

CVE-2022-28143

A cross-site request forgery CSRF vulnerability in Jenkins Proxmox Plugin 0.7.0 and earlier allows attackers to connect to an attacker-specified host using attacker-specified username and password perform a connection test, disable SSL/TLS validation for the entire Jenkins controller JVM as part ...