Trend Micro Apex One 代码问题漏洞

Trend Micro Apex One is an endpoint protection software from Trend Micro. Trend Micro Apex One suffers from a code issue vulnerability that stems from the presence of uncontrolled search path elements in the application. A local attacker could use this vulnerability to load a DLL on an affected...

CVE-2022-23050

ManageEngine AppManager15 Build No:15510 allows an authenticated admin user to upload a DLL file to perform a DLL hijack attack inside the 'working' folder through the 'Upload Files / Binaries' functionality...

Liferay Portal and Liferay DXP Fails to Properly Check User Permissions

The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 6, does not properly check user permissions, which allows remote attackers with the forms "Access in Site Administration" permission to vi...

GHSA-GJJM-4X3G-3H33 Magento 2 Community Edition XSS Vulnerability

A stored cross-site scripting XSS vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary Javascript code into the dynamic block when invoking page builder on a product...

Dolibarr ERP and CRM Code Injection

Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor also allowed inclusion of dynamic code, which can lead to code execution on the host machine. An attacker has to check a setting on the sam...

GHSA-JWG3-V9XM-V6Q9 Dolibarr ERP and CRM Code Injection

Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor also allowed inclusion of dynamic code, which can lead to code execution on the host machine. An attacker has to check a setting on the sam...

Telecommunication Software SAMwin Contact Center Suite 信任管理问题漏洞

Telecommunication Software SAMwin Contact Center Suite is a highly versatile and flexible contact center software solution from Telecommunication Software. A security vulnerability exists in Telecommunication Software SAMwin Contact Center Suite version 5.1, which stems from a function...

CVE-2022-31467

A DLL hijacking vulnerability in the installed for Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, leading to execution of arbitrary code, via the installer not restricting the search path for required DLLs and then not verifying the signature...

Quick Heal 代码问题漏洞

Quick Heal is an antivirus software from Quick Heal that provides IT security solutions for your PC, Mac, phone, tablet and corporate network. A code issue vulnerability exists in versions prior to Quick Heal Total Security 12.1.1.27, which stems from a lack of privilege control during applicatio...

CVE-2022-29028

A vulnerability has been identified in JT2Go All versions V13.3.0.3, Teamcenter Visualization V13.3 All versions V13.3.0.3, Teamcenter Visualization V14.0 All versions V14.0.0.1. The TiffLoader.dll is vulnerable to infinite loop condition while parsing specially crafted TIFF files. An attacker...

CVE-2022-28965

Multiple DLL hijacking vulnerabilities via the components instup.exe and wscproxy.exe in Avast Premium Security before v21.11.2500 allows attackers to execute arbitrary code or cause a Denial of Service DoS via a crafted DLL file...

CVE-2022-28964

An arbitrary file write vulnerability in Avast Premium Security before v21.11.2500 build 21.11.6809.528 allows attackers to cause a Denial of Service DoS via a crafted DLL file...

GHSA-HP87-P4GW-J4GQ vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner, thanos-operator...

GHSA-HP87-P4GW-J4GQ vulnerabilities

Vulnerabilities for packages: thanos-operator-fips, dynamic-localpv-provisioner, dynamic-localpv-provisioner-fips, thanos-operator...

Avast Premium Security 代码问题漏洞

Avast Premium Security is an application from the Czech company Avast. Avast Premium Security suffers from a DLL hijacking vulnerability that originates when the instup.exe and wscproxy.exe processes attempt to load a DLL by failing to specify the absolute path to the DLL. An attacker could use...

The vulnerability of the Git distributed version control system’s uninstaller allows a hacker to increase their privileges.

The vulnerability of the Git distributed version control system’s uninstaller is related to an uncontrolled element in the loading process of DLL libraries. Exploiting this vulnerability can allow attackers to enhance their privileges using specially created malicious files with the extension .dl...

CVE-2022-28948 vulnerabilities

Vulnerabilities for packages: thanos-operator-fips, dynamic-localpv-provisioner, dynamic-localpv-provisioner-fips, thanos-operator...

CVE-2022-28948 vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner, thanos-operator...

SQL injetction

Description SQL injection exists in the camptocamp/terraboard. Among all APIs there is an API routed to /api/search/attribute, whose corresponding method is api.SearchAttribute. In the api.SearchAttribute method, the program takes the request parameters and passes them into the db.SearchAttribute...

The vulnerability of the ViPNet Client’s software-hardware protection system lies in its ability to replace the dynamic library, allowing an attacker to execute arbitrary code.

The vulnerability of the ViPNet Client software lies in the possibility of replacing the dynamic library. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially crafted dynamic library...