s::can moni::tools 路径遍历漏洞

s::can moni::tools is a platform from s::can for managing a virtually unlimited number of sites, online probes, analyzers, and parameters. A path traversal vulnerability exists in s::can moni::tools version 4.2 and earlier. An attacker can exploit this vulnerability to obtain any file...

PT-2022-27025 · Suse · Suse Linux Enterprise Module For Suse Manager Server 4.2 +3

Name of the Vulnerable Software and Affected Versions: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 versions prior to 4.2.28 SUSE Linux Enterprise Module for SUSE Manager Server 4.3 spacewalk-java versions prior to 4.3.39 SUSE Manager Server 4.2 release-notes-susemanager versions prio...

CVE-2022-43361

Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting XSS vulnerability via the component popchart.php...

AZL-11350 CVE-2022-3474 affecting package bazel for versions less than 5.3.2-1

A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3...

mxGraph 跨站脚本漏洞

mxGraph is a JavaScript charting library. A security vulnerability exists in mxGraph version v4.2.2, which stems from the discovery of a cross-site scripting XSS vulnerability contained via the setTooltips function...

IBM WebSphere Automation 跨站请求伪造漏洞

IBM WebSphere Automation is an operations platform from International Business Machines IBM. automates operational activities to proactively mitigate security risks and accelerate threat remediation. A cross-site request forgery vulnerability exists in IBM WebSphere Automation for IBM Cloud Pak f...

PT-2022-25851 · Liferay · Liferay Portal

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.0.0 through 7.4.2 Description: The issue is related to an insecure default in the auth.login.prompt.enabled component, which allows attackers to enumerate usernames, site names, and pages. Recommendations: For Lifera...

UBUNTU-CVE-2022-2628

The DSGVO All in one for WP WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Liferay Portal 路径遍历漏洞

Liferay Portal is a J2EE-based portal solution from Liferay, Inc. The solution uses technologies such as EJB as well as JMS, and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, and more. A security vulnerability exists in Liferay Portal...

PT-2022-34186 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.212 Description: A potential divide by zero error in the fb pm2fb function of the Linux Kernel may pose a security risk. The actual impact and attack plausibility have not yet been proven. Recommendations:...

PT-2022-34199 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.212 Description: A data-race issue exists around netdev budget. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v2.6.13 and is fixed in Linux Kernel...

Pixel＆tonic Craft CMS 跨站脚本漏洞

Pixel & tonic Craft CMS is a content management system CMS from the US company Pixel & tonic. A cross-site scripting vulnerability exists in Craft CMS version 4.2.0.1, which stems from a security issue in the src/helpers/Cp.php page...

PYSEC-2022-272

Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2...

Rdiffweb 安全漏洞

Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. It provides quick access to your archives through an efficient web interface. A security vulnerability exists in Rdiffweb versions prior to 2.4.2, which stems from the loss of a custom error page...

PT-2022-5211 · Adobe · Indesign

Name of the Vulnerable Software and Affected Versions: Adobe InDesign versions 16.4.2 and earlier Adobe InDesign versions 17.3 and earlier Description: The issue is related to an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this...

SAP BusinessObjects Business Intelligence Platform 信息泄露漏洞

SAP BusinessObjects Business Intelligence Platform is a complete business analytics platform from SAP. The platform combines market-leading SAP data integration products, data management products, and business intelligence BI products to eliminate system integration challenges and quickly and...

PT-2022-5055 · Adobe · Indesign

Name of the Vulnerable Software and Affected Versions: Adobe InDesign versions 16.4.2 and earlier Adobe InDesign versions 17.3 and earlier Description: The issue is related to an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user...

PT-2022-5207 · Adobe · Indesign

Name of the Vulnerable Software and Affected Versions: Adobe InDesign versions 16.4.2 and earlier Adobe InDesign versions 17.3 and earlier Description: The issue is related to a heap-based buffer overflow in the dynamic memory of Adobe InDesign, which could allow an attacker to execute arbitrary...

CVE-2022-38291

SLiMS Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting XSS vulnerability via the Search function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search bar...

PT-2022-18686 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! version 4.2.0 Description: An issue was discovered in Joomla! where multiple Full Path Disclosures occur due to a missing ' JEXEC or die check' caused by the PSR12 changes. Recommendations: For Joomla! version 4.2.0, consider adding t...