PT-2022-9211 · Anycubic · Anycubic Chitubox Anycubic Plugin

Name of the Vulnerable Software and Affected Versions: AnyCubic Chitubox AnyCubic Plugin version 1.0.0 Description: A heap-based buffer overflow issue exists in the readDatHeadVec functionality. This can be triggered by a specially-crafted GF file, leading to a heap buffer overflow. An attacker c...

PT-2022-16918 · Unknown · Postgresql +1

Name of the Vulnerable Software and Affected Versions: Gin-vue-admin versions prior to 2.5.1 Description: The issue occurs in the server/service/system/sys auto code pgsql.go code, which means PostgreSQL must be used as the database for this problem to occur. Users must have JWT login and be usin...

PT-2022-18940 · Bentley · Microstation Connect

Name of the Vulnerable Software and Affected Versions: Bentley MicroStation CONNECT version 10.16.02.34 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicio...

PT-2022-18955 · Bentley · Microstation Connect

Name of the Vulnerable Software and Affected Versions: Bentley MicroStation CONNECT version 10.16.02.34 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicio...

PT-2022-13730 · Bentley · Microstation Connect

Name of the Vulnerable Software and Affected Versions: Bentley MicroStation CONNECT version 10.16.2.034 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicio...

PT-2022-18953 · Bentley · Microstation Connect

Name of the Vulnerable Software and Affected Versions: Bentley MicroStation CONNECT version 10.16.02.34 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicio...

PT-2022-18942 · Bentley · Bentley Microstation Connect

Name of the Vulnerable Software and Affected Versions: Bentley MicroStation CONNECT version 10.16.02.034 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a...

SAP 3D Visual Enterprise Viewer 输入验证错误漏洞

SAP 3D Visual Enterprise Viewer is a 3D view viewer from SAP Germany. SAP 3D Visual Enterprise Viewer version 9.0 is vulnerable to an input validation error that could be exploited to crash the application and temporarily disable users until the application is restarted. The application can be...

Grafana fine-grained access control API Key privilege escalation

Grafana is an open-source platform for monitoring and observability. When fine-grained access control is enabled and a client uses Grafana API Key to make requests, the permissions for that API Key are cached for 30 seconds for the given organization. Because of the way the cache ID is constructe...

PT-2022-18246 · Unknown · Express-Fileupload

Name of the Vulnerable Software and Affected Versions: express-fileupload version 1.3.1 Description: An arbitrary file upload vulnerability in the file upload module of express-fileupload allows attackers to execute arbitrary code via a crafted PHP file. The vendor's position is that the observed...

SAP 3D Visual Enterprise Viewer 输入验证错误漏洞

SAP 3D Visual Enterprise Viewer is a 3D view viewer from SAP Germany. SAP 3D Visual Enterprise Viewer version 9.0 is vulnerable to an input validation error that could be exploited to crash the application and temporarily disable the user until the application is restarted. The application can be...

PT-2022-17522 · Autodesk · Autodesk Fbx Review

Name of the Vulnerable Software and Affected Versions: Autodesk FBX Review versions 1.5.2 and prior Description: An Out-Of-Bounds Read issue may lead to code execution or information disclosure through maliciously crafted ActionScript Byte Code ABC files. These ABC files, created by the Flash...

UBUNTU-CVE-2022-24793

PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.12 and prior affects applications that use PJSIP DNS resolution. It doesn't affect PJSIP users who utilize an external resolver. This vulnerability is related to...

CVE-2022-23440

A use of hard-coded cryptographic key vulnerability CWE-321 in the registration mechanism of FortiEDR collectors versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow a local attacker to disable and uninstall the collectors from the end-points within the same deployment...

CVE-2022-23440

A use of hard-coded cryptographic key vulnerability CWE-321 in the registration mechanism of FortiEDR collectors versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow a local attacker to disable and uninstall the collectors from the end-points within the same deployment...

Hardcoded credentials

A use of hard-coded cryptographic key vulnerability CWE-321 in the registration mechanism of FortiEDR collectors versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow a local attacker to disable and uninstall the collectors from the end-points within the same deployment...

CVE-2022-23440

A use of hard-coded cryptographic key vulnerability CWE-321 in the registration mechanism of FortiEDR collectors versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow a local attacker to disable and uninstall the collectors from the end-points within the same deployment...

The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature or via SAX using the XERCES_DISABLE_DTD environment variable.

...

Fortinet FortiEDR 信任管理问题漏洞

Fortinet FortiEDR is a scratch-built endpoint security solution from Fortinet U.S.A. Fortinet FortiEDR is vulnerable to a trust management issue that stems from the use of hard-coded encrypted RSA keys, which can be exploited by local attackers to disable and offload collectors from endpoints in...

PT-2022-2680 · Pjsip +2 · Pjsip +2

Name of the Vulnerable Software and Affected Versions: PJSIP versions 2.12 and prior Description: The issue is related to the implementation of the pjmedia rtcp fb parse rpsi function in the PJSIP multimedia communication library. It is associated with a buffer overflow in memory when processing ...