OpenStack Kolla sudo privilege escalation vulnerability

A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a container can lead to increased privileges...

CVE-2022-38060

A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a container can lead to increased privileges...

Design/Logic Flaw

Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications. Installers generated by Squirrel.Windows 2.0.1 and earlier contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries...

NFT operators of OpenZeppelin-based NFTs can issue debt

Lines of code Vulnerability details Description The Papr protocol allows NFT owners to issue debt against NFTs they deposit, denominated in papr. The solmate contracts that are used as imports for the project do not allow an operator on the NFT to participate in debt-creation; the ERC721 contract...

CVE-2022-29517

A directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary file upload. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-43486

Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command on the affected devices...

CVE-2022-43486

Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command on the affected devices...

Denial of service

Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command on the affected devices...

PT-2022-26938 · Buffalo · Buffalo Network Devices

Name of the Vulnerable Software and Affected Versions: Buffalo network devices affected versions not specified Description: A hidden functionality issue in Buffalo network devices allows an attacker with administrative privileges to enable debug functionalities and execute arbitrary commands on t...

CVE-2022-43486

Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command on the affected devices...

CVE-2022-4326

The CVE-2022-4326 issue affects Trellix Endpoint Agent (xAgent) on Windows prior to V35.31.22. A faulty removal-protection permissions scheme allows a local administrator to bypass protections and uninstall the agent. Affected component is the removal-protection mechanism within xAgent; root caus...

National Sleep Research Resource 跨站脚本漏洞

National Sleep Research Resource is an open source national sleep research resource system by National Sleep Research Resource. A cross-site scripting vulnerability exists in National Sleep Research Resource versions prior to 59.0.0 that stems from the presence of unknown functionality...

Zoom Client for Meetings < 2.5.146186.1130 Vulnerability (ZSB-18001)

The version of Zoom Client for Meetings installed on the remote host is prior to 2.5.146186.1130. It is, therefore, affected by a vulnerability as referenced in the ZSB-18001 advisory. - A vulnerability in the Zoom client could allow a remote, unauthenticated attacker to control meeting...

Zoom Client for Meetings < 4.1.34475.1105 Vulnerability (ZSB-18001)

The version of Zoom Client for Meetings installed on the remote host is prior to 4.1.34475.1105. It is, therefore, affected by a vulnerability as referenced in the ZSB-18001 advisory. - A vulnerability in the Zoom client could allow a remote, unauthenticated attacker to control meeting...

SOUND4 IMPACT/FIRST/PULSE/Eco 2.x upload.cgi Code Execution

!/usr/bin/env python SOUND4 IMPACT/FIRST/PULSE/Eco =2.x upload.cgi Unauthenticated Remote Code Execution Vendor: SOUND4 Ltd. Product web page: https://www.sound4.com | https://www.sound4.biz Affected version: FM/HD Radio Processing: Impact/Pulse/First Version 2: 1.1/2.15 Impact/Pulse/First Versio...

GHSA-P782-4J23-XQCG Apache Atlas: zip path traversal in import functionality

A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas versions from 0.8.4 to 2.2.0...

CVE-2022-34271 Apache Atlas: zip path traversal in import functionality

A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas versions from 0.8.4 to 2.2.0...

CVE-2022-41268

In some SAP standard roles in SAP Business Planning and Consolidation - versions - SAPBW 750, 751, 752, 753, 754, 755, 756, 757, DWCORE 200, 300, CPMBPC 810, a transaction code reserved for the customer is used. By implementing such transaction code, a malicious user may execute unauthorized...

WPQA < 5.9.3 - Missing validation lead to functionality abuse

The plugin which is a companion plugin used with Discy and Himer themes incorrectly tries to validate that a user already follows another in the wpqafollowingyouajax action, allowing a user to inflate their score on the site by having another user send repeated follow actions to them. PoC...

WPQA < 5.9.3 - Missing validation lead to functionality abuse

The plugin which is a companion plugin used with Discy and Himer themes incorrectly tries to validate that a user already follows another in the wpqafollowingyouajax action, allowing a user to inflate their score on the site by having another user send repeated follow actions to them...