CVE-2022-30946

A cross-site request forgery CSRF vulnerability in Jenkins Script Security Plugin 1158.v7c1b73a69a08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver...

@akumzy/graphql-schema-generator (>=0.2.0, <=0.5.1), @appxdigital/appx-core (0.1.83) +443 more potentially affected by CVE-2022-35948 via undici (>=5.0.0, <=5.8.1)

undici NPM version =5.0.0, =0.2.0, =0.2.1, =0.2.11, =2.0.0, =1.6.0, =1.0.0, =0.2.0-beta.0, =1.0.0, =0.3.0, =0.3.21 and more Source cves: CVE-2022-35948 Source advisory: OSV:GHSA-F772-66G8-Q5H3...

@akumzy/graphql-schema-generator (>=0.2.0, <=0.5.1), @appxdigital/appx-core (0.1.83) +443 more potentially affected by CVE-2022-35949 via undici (>=5.0.0, <=5.8.1)

undici NPM version =5.0.0, =0.2.0, =0.2.1, =0.2.11, =2.0.0, =1.6.0, =1.0.0, =0.2.0-beta.0, =1.0.0, =0.3.0, =0.3.21 and more Source cves: CVE-2022-35949 Source advisory: OSV:GHSA-8QR4-XGW6-WMR3...

Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2022-2270)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Critical severity command injection vulnerability - CVE-2022-36804

h3. Command injection vulnerability through malicious HTTP requests There is a command injection vulnerability in multiple API endpoints of Bitbucket Server and Data Center. An attacker with access to a public Bitbucket repository or with read permissions to a private one can execute arbitrary co...

CVE-2022-35147

DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request...

Cross site request forgery (csrf)

DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request...

CVE-2022-35147

DoraCMS v2.18 and earlier has an authentication bypass vulnerability (CVE-2022-35147). The issue allows an attacker to bypass login via a crafted HTTP request, enabling unauthorized access. Affected software is DoraCMS, versions up to 2.18; root cause involves bypassing authentication logic. Impa...

openSUSE: Security Advisory for python-Twisted (SUSE-SU-2022:2822-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

EulerOS 2.0 SP8 : httpd (EulerOS-SA-2022-2222)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows an attacker to...

EulerOS 2.0 SP10 : httpd (EulerOS-SA-2022-2256)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows an attacker to...

EulerOS 2.0 SP5 : httpd (EulerOS-SA-2022-2270)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows an attacker to...

SUSE: Security Advisory (SUSE-SU-2022:2822-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-35147: Exposure of Sensitive Information to an Unauthorized Actor

DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request...

EulerOS 2.0 SP10 : httpd (EulerOS-SA-2022-2243)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows an attacker to...

SUSE-SU-2022:2822-1 Security update for python-Twisted

This update for python-Twisted fixes the following issues: - CVE-2020-10109: Fixed an HTTP request smuggling issue bsc1166458...

SUSE-SU-2022:2811-1 Security update for python-Twisted

This update for python-Twisted fixes the following issues: - CVE-2020-10108: Fixed an HTTP request smuggling issue bsc1166457. - CVE-2020-10109: Fixed an HTTP request smuggling issue bsc1166458...

CVE-2022-2838: Improper Restriction of XML External Entity Reference

In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allowing the injection of arbitrary definitions which is able to access local files and expose their contents via HTTP requests...

WWBN AVideo image403 cross-site scripting (XSS) vulnerability

Talos Vulnerability Report TALOS-2022-1539 WWBN AVideo image403 cross-site scripting XSS vulnerability August 16, 2022 CVE Number CVE-2022-30690 SUMMARY A cross-site scripting xss vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A...

WWBN AVideo aVideoEncoder chunkfile OS command injection vulnerability

Talos Vulnerability Report TALOS-2022-1546 WWBN AVideo aVideoEncoder chunkfile OS command injection vulnerability August 16, 2022 CVE Number CVE-2022-30534 SUMMARY An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit...