Insyde InsydeH2O 安全漏洞

Insyde InsydeH2O is a C source from Insyde Corporation of Taiwan, which implements the new technology "EFI/UEFI" specification, designed to replace the traditional BIOS Basic Input/Output System. A security vulnerability exists in Insyde InsydeH2O with kernel versions 5.0 through 5.5. An attacker...

CVE-2022-43765

B&R APROL versions R 4.2-07 doesn’t process correctly specially formatted data packages sent to port 55502/tcp, which may allow a network based attacker to cause an application Denial-of-Service...

QNAP Fixes Critical Vulnerability in NAS Devices with Latest Security Updates

Taiwanese company QNAP has released updates to remediate a critical security flaw affecting its network-attached storage NAS devices that could lead to arbitrary code injection. Tracked as CVE-2022-27596, the vulnerability is rated 9.8 out of a maximum of 10 on the CVSS scoring scale. It affects...

PT-2023-14189 · WordPress · Wp Attachments

Name of the Vulnerable Software and Affected Versions: WP Attachments WordPress plugin versions prior to 5.0.6 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example in...

WordPress plugin WP Attachments 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2022-27642 · Hillstone · Hillstone Firewall Sg-6000

Name of the Vulnerable Software and Affected Versions: Hillstone Firewall SG-6000 versions 5.0.4.0 and earlier Description: The issue is related to incorrect access control, allowing an attacker to bypass permissions and gain super administrator privileges in the background of the firewall. This ...

GHSA-2J2X-2GPW-G8FM flat vulnerable to Prototype Pollution

flat helps flatten/unflatten nested Javascript objects. A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes...

CVE-2022-20503

creationtimestamp| type| source ---|---|--- 2022-12-16 18:37:40+00:00| seen| https://t.me/cibsecurity/54739...

CVE-2022-41560

The Statement Set Upload via the Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a Denial of Service Attack on the affected system. Affected releases are TIBCO Software...

PT-2022-6946 · Redmine · Redmine

Name of the Vulnerable Software and Affected Versions: Redmine versions 5.x before 5.0.4 Description: The issue is related to incorrect handling of exceptional states in the Redmine web application for project and task management. It may allow a remote attacker to upload and execute arbitrary...

Vulnerabilities fixed in Sophos firewall

Sophos has fixed several vulnerabilities in Sophos firewall. A malicious party could exploit the vulnerabilities to obtain system data through API calls and Cross-Site-Scripting XSS attacks. In addition, arbitrary code can be executed if the malicious party has gained management rights or gained...

PT-2022-23314 · Insyde · Insydeh2O

Name of the Vulnerable Software and Affected Versions: Insyde InsydeH2O with kernel 5.0 through 5.5 Description: A stack buffer overflow vulnerability in the MebxConfiguration driver can lead to arbitrary code execution. This issue occurs when a UEFI variable under the OS is read by BIOS code,...

Insyde InsydeH2O 缓冲区错误漏洞

Insyde InsydeH2O is a C-language source from Insyde Corporation of Taiwan, which implements the new technology "EFI/UEFI" specification designed to replace the traditional BIOS Basic Input/Output System. A security vulnerability exists in Insyde InsydeH2O versions 5.0 through 5.5, which is caused...

PT-2022-26825 · Unknown · Limesurvey

Name of the Vulnerable Software and Affected Versions: LimeSurvey versions prior to 5.0.4 Description: A SQL injection issue was found in the component /application/views/themeOptions/update.php. Recommendations: For versions prior to 5.0.4, update to version 5.0.4 or later to resolve the issue...

Insyde InsydeH2O 缓冲区错误漏洞

Insyde InsydeH2O is a C-language source from Insyde Corporation of Taiwan, which implements the new technology "EFI/UEFI" specification designed to replace the traditional BIOS Basic Input/Output System. A security vulnerability exists in Insyde InsydeH2O 5.0 to 5.5, which originates from an SMI...

PYSEC-2022-43000

Insufficient Session Expiration in GitHub repository ikus060/rdiffweb prior to 2.5.0...

PT-2022-22298 · WordPress · Wp Attachments

Name of the Vulnerable Software and Affected Versions: WP Attachments versions prior to 5.0.5 Description: The issue allows high-privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitized and escaped. The atta...

PT-2022-21928 · Intel · Intel Dcm

Name of the Vulnerable Software and Affected Versions: IntelR DCM software versions prior to 5.0 Description: The issue is related to a protection mechanism failure in the IntelR DCM software, which may allow an unauthenticated user to potentially enable escalation of privilege via adjacent acces...

CVE-2022-39890

Improper Authorization in Samsung Billing prior to version 5.0.56.0 allows attacker to get sensitive information...

PT-2022-22374 · Unknown · Clusterpro X +3

Name of the Vulnerable Software and Affected Versions: CLUSTERPRO X versions 5.0 and earlier EXPRESSCLUSTER X versions 5.0 and earlier CLUSTERPRO X SingleServerSafe versions 5.0 and earlier EXPRESSCLUSTER X SingleServerSafe versions 5.0 and earlier Description: The issue allows a remote...