SUSE CVE-2018-17537

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. blog-viewer has stored XSS during repository browsing, if package.json exists...

CVE-2023-23126

Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform unintended actions. NOTE: the vendor's position is that a Content-Security-Policy HTTP response header is present to block this attack...

Google Android 资源管理错误漏洞

Google Android is a Linux-based open source operating system from Google. A security vulnerability exists in Google Android. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor's announcement...

CLSA-2022-1671033543 vim: Fix of CVE-2022-4292

CVE-2022-4292: bail out if the window no longer exists...

CLSA-2022-1671032897 vim: Fix of CVE-2022-4292

CVE-2022-4292: bail out if the window no longer exists...

Microsoft Windows Secure Socket Tunneling Protocol 安全漏洞

The Microsoft Windows Secure Socket Tunneling Protocol is a Microsoft mechanism for encapsulating Point-to-Point Protocol PPP traffic via the HTTPS protocol, as specified in RFC1945, RFC2616, and RFC2818. This protocol enables users to access private networks using HTTPS. HTTPS can traverse most...

Mozilla Firefox 资源管理错误漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozila Firefox. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor announcement...

UBUNTU-CVE-2022-39229

Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username and email address are unique fields, th...

Plugin signature bypass

Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are...

PYSEC-2022-282

If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists...

CVE-2022-39135

Apache Calcite 1.22.0 introduced the SQL operators EXISTSNODE, EXTRACTXML, XMLTRANSFORM and EXTRACTVALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity XXE attack. Therefore any client exposing these operators,...

Apache Calcite 代码问题漏洞

Apache Calcite is an open source framework from the Apache USA Foundation for building databases and data management systems. A code issue vulnerability exists in Apache Calcite versions prior to 1.32.0 that stems from the SQL operators EXISTSNODE, EXTRACTXML, XMLTRANSFORM, and EXTRACTVALUE not...

Malicious code in ommand-eixsts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dff4a18f2a0d0e6eefb2391898ea53748e4aae1bef44b187aa38f3f4492dbc0a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in apth-exists (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6cddb4cfcf014f98dd8994e76c4ce298a83392232bb337efe3777ae8ce0b493b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1077 Malicious code in apth-exists (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6cddb4cfcf014f98dd8994e76c4ce298a83392232bb337efe3777ae8ce0b493b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Vulnerability in core server (CVE-2022-2625)

Extension scripts replace objects not belonging to the extension Some extensions use CREATE OR REPLACE or CREATE IF NOT EXISTS commands. Some don't adhere to the documented rule to target only objects known to be extension members already. An attack requires permission to create non-temporary...

mariadb: crash when using HAVING with NOT EXIST predicate in an equality

A flaw was found in the MariaDB Server. It contains a segmentation fault via the component, sql/itemsubselect.cc, affecting availability...

mariadb: crash when using HAVING with NOT EXIST predicate in an equality

A flaw was found in the MariaDB Server. It contains a segmentation fault via the component, sql/itemsubselect.cc, affecting availability...

mariadb: crash when using HAVING with NOT EXIST predicate in an equality

A flaw was found in the MariaDB Server. It contains a segmentation fault via the component, sql/itemsubselect.cc, affecting availability...

web2py 输入验证错误漏洞

web2py is web2py open source a free and open source full stack enterprise framework. Used for agile development of secure database-driven Web-based applications. A security vulnerability exists in web2py. No information about this vulnerability is available at this time, please stay tuned to CNNV...