PYSEC-2022-208

django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entire AWS S3 bucket and in most cases to access or delete files. If the AWSLOCATION setting was set, traversal was limited to that location only. The issue was...

PT-2022-13995 · WordPress · Wpqa Builder

Name of the Vulnerable Software and Affected Versions: WPQA Builder WordPress plugin versions prior to 5.5 Description: The issue concerns a lack of authentication in a REST API endpoint, allowing unauthenticated users to discover private questions sent between users on the site. This affects the...

CVE-2022-21419

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware component: Visual Analyzer. Supported versions that are affected are 5.5.0.0.0 and 5.9.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2021-40386

Kaseya Unitrends Client/Agent through 10.5,5 allows remote attackers to execute arbitrary code...

AntD Admin 访问控制错误漏洞

AntD Admin is an excellent front-end solution for enterprise applications built on Ant Design and UmiJs by Zuiidea individual developers. A security vulnerability exists in AntD Admin, which originates from Antd-admin 5.5.0 is affected by a False Access Control vulnerability. An attacker can...

CVE-2022-23856

An issue was discovered in Saviynt Enterprise Identity Cloud EIC 5.5 SP2.x. An attacker can enumerate users by changing the id parameter, such as for the ECM/maintenance/forgotpasswordstep1 URI...

PT-2022-16294 · Saviynt · Saviynt Enterprise Identity Cloud

Name of the Vulnerable Software and Affected Versions: Saviynt Enterprise Identity Cloud EIC version 5.5 SP2.x Description: An issue was discovered that allows an attacker to enumerate users by changing the id parameter in the "ECM/maintenance/forgotpasswordstep1" API endpoint. Recommendations: F...

CVE-2021-43019

Adobe Creative Cloud version 5.5 and earlier are affected by a privilege escalation vulnerability in the resources leveraged by the Setup.exe service. An unauthenticated attacker could leverage this vulnerability to remove files and escalate privileges under the context of SYSTEM . An attacker mu...

Yzmcms 代码问题漏洞

YzmCMS is a lightweight open source content management system based on PHP Mysql architecture developed solely by Yuan Zhimeng. a server-side request forgery vulnerability exists in the grabimage function in YzmCMS version 5.5. No detailed vulnerability details are provided...

VulnCheck KEV: CVE-2014-0640

EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote authenticated users to bypass intended restrictions on resource access via unspecified vectors...

CVE-2020-18229

Cross Site Scripting XSS in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfgcopyright" of component " /admin/webconfig.php"...

WordPress 插件安全漏洞

WordPress Plugin is an open source application plugin for WordPress. A security vulnerability exists in the WordPress plugin EWWW Image Optimizer prior to version 2.8.5 that allows remote command execution because it relies on a protection mechanism involving boolval, which was not available prio...

Marvell QConvergeConsole GUI Authorization Issues Vulnerability

Marvell QConvergeConsole QCC is a unified adapter management software across data centers from Marvell. The software is primarily used for Ethernet and Fibre Channel adapter management, among other things. A security vulnerability exists in the Marvell QConvergeConsole GUI version 5.5.0.74 and...

UBUNTU-CVE-2021-20177

A flaw was found in the Linux kernel's implementation of string matching within a packet. A privileged user with root or CAPNETADMIN when inserting iptables rules could insert a rule which can panic the system. Kernel before kernel 5.5-rc1 is affected...

CVE-2020-5638

Cross-site scripting vulnerability in desknet's NEO desknet's NEO Small License V5.5 R1.5 and earlier, and desknet's NEO Enterprise License V5.5 R1.5 and earlier allows remote attackers to inject arbitrary script via unspecified vectors...

YzmCMS Cross-Site Scripting Vulnerability (CNVD-2020-66575)

YzmCMS is a lightweight open source content management system based on PHP+Mysql architecture developed by Yuan Zhimeng alone. A cross-site scripting vulnerability exists in the member submission feature in YzmCMS 5.5. No detailed vulnerability details are available at this time...

CVE-2020-22394

In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting XSS vulnerability...

CVE-2020-7198

There is a remote escalation of privilege possible for a malicious user that has a OneView account in OneView and Synergy Composer. HPE has provided updates to Oneview and Synergy Composer: Update to version 5.5 of OneView, Composer, or Composer2...

VMware Horizon Client for Windows Information Disclosure Vulnerability

VMware Horizon Client is a client application for connecting to VMware Horizon virtual desktops from VMware. An information disclosure vulnerability exists in VMware Horizon Client for Windows 5.x series versions prior to 5.5.0, which can be exploited by an attacker to retrieve hashed credentials...

CVE-2020-14864

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware component: Installation. Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via...