Remote Code Execution (RCE)

Overview Affected versions of this package are vulnerable to Remote Code Execution RCE in the ExpressionContextImpl class via jexl.createExpressionexpression.evaluatecontext; functionality, due to improper user input validation. Remediation There is no fixed version for com.bstek.uflo:uflo-core...

io.jenkins.blueocean:blueocean (>=1.1.0-beta-4, <=1.2.0-beta-1), io.jenkins.blueocean:blueocean-events (>=1.1.0-beta-4, <=1.2.0-beta-1) +3 more potentially affected by CVE-2022-43407 via org.jenkins-ci.plugins:pipeline-input-step (2.7)

org.jenkins-ci.plugins:pipeline-input-step MAVEN version 2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:pipeline-input-step and may be impacted: - io.jenkins.blueocean:blueocean =1.1.0-beta-4, =1.1.0-beta-4, =1.1.0-beta-4,...

io.jenkins.blueocean:blueocean (>=1.1.6, <=1.1.7), io.jenkins.blueocean:blueocean-events (>=1.1.6, <=1.1.7) +6 more potentially affected by CVE-2022-43407 via org.jenkins-ci.plugins:pipeline-input-step (2.8)

org.jenkins-ci.plugins:pipeline-input-step MAVEN version 2.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:pipeline-input-step and may be impacted: - io.jenkins.blueocean:blueocean =1.1.6, =1.1.6, =1.1.6, =1.1.6, =2.0.0, =1.7,...

io.jenkins.blueocean:blueocean (>=1.1.0, <=1.1.7), io.jenkins.blueocean:blueocean-events (>=1.1.0, <=1.1.7) +5 more potentially affected by CVE-2022-43404 via org.jenkins-ci.plugins.workflow:workflow-cps (2.31)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.31 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.jenkins.blueocean:blueocean =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0,...

io.jenkins.blueocean:blueocean (>=1.0-alpha-1, <=1.0-alpha-2), io.jenkins.blueocean:blueocean-dashboard (>=1.0-alpha-1, <=1.0-alpha-2) +2 more potentially affected by CVE-2022-43402 via org.jenkins-ci.plugins.workflow:workflow-cps (2.1)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.jenkins.blueocean:blueocean =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1,...

io.jenkins.blueocean:blueocean (1.2.0-beta-1), io.jenkins.blueocean:blueocean-events (1.2.0-beta-1) +5 more potentially affected by CVE-2022-43404 via org.jenkins-ci.plugins.workflow:workflow-cps (2.36)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.36 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.jenkins.blueocean:blueocean 1.2.0-beta-1 -...

io.jenkins.blueocean:blueocean (>=1.0-alpha-1, <=1.0-alpha-2), io.jenkins.blueocean:blueocean-dashboard (>=1.0-alpha-1, <=1.0-alpha-2) +2 more potentially affected by CVE-2022-43404 via org.jenkins-ci.plugins.workflow:workflow-cps (2.1)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - io.jenkins.blueocean:blueocean =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1,...

CVE-2022-20398

In addOrUpdateNetwork of WifiServiceImpl.java, there is a possible way for a guest user to configure Wi-Fi due to a permissions bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2022-36862

A heap-based overflow vulnerability in HWR::EngineCJK::Impl::Construct in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault...

CVE-2022-36862

A heap-based overflow vulnerability in HWR::EngineCJK::Impl::Construct in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault...

CVE-2022-36862: Heap-based Buffer Overflow

A heap-based overflow vulnerability in HWR::EngineCJK::Impl::Construct in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault...

CVE-2022-35121

Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java...

CVE-2022-35121

Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java...

CVE-2022-35121: Improper Neutralization of Special Elements used in an SQL Command

Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java...

io.jenkins.blueocean:blueocean (>=1.1.0-beta-2, <=1.2.0-beta-1), io.jenkins.blueocean:blueocean-events (>=1.1.0-beta-2, <=1.2.0-beta-1) +4 more potentially affected by CVE-2022-36884 via org.jenkins-ci.plugins:git (3.3.0)

org.jenkins-ci.plugins:git MAVEN version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - io.jenkins.blueocean:blueocean =1.1.0-beta-2, =1.1.0-beta-2, =1.1.0-beta-2, =1.1.0-beta-2, =1.1.0-beta-2,...

PT-2022-3314

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 102 Firefox ESR versions prior to 91.11 Thunderbird versions prior to 102 Thunderbird versions prior to 91.11 Description The issue is related to an integer overflow in the nsTArray Impl::ReplaceElementsAt function...

Malicious code in @bmw-ispi-workplace/dms-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6898e8320468b4c586b03d0d2846a7e478816d08de35b21e51f3c6bc1d3a1324 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ui-sfdc-javascript-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e014b3d7a9c682041c47e65f5c0c327fed3a54fa614920a8f64c09876b7e90ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6756 Malicious code in ui-sfdc-javascript-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e014b3d7a9c682041c47e65f5c0c327fed3a54fa614920a8f64c09876b7e90ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

audir (0.1.0), com-impl (>=0.1.0, <=0.1.1) +6 more potentially affected by CVE-2021-45681 via derive-com-impl (0.1.1)

derive-com-impl CARGO version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on derive-com-impl and may be impacted: - audir 0.1.0 - com-impl =0.1.0, =0.3.0-alpha1, =0.3.0-alpha1, =0.3.0-alpha4 - dxgi 0.3.0-alpha4 - wic 0.3.0-alpha1 Source cves:...