p4 操作系统命令注入漏洞

p4 is a small utility library for working with Perforce by the individual developer Nate Long. An operating system command injection vulnerability exists in versions prior to p4 0.0.7, which stems from incorrect input cleanup, and a command injection vulnerability via the run function...

Rockwell Automation GuardLogix and ControlLogix controllers

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: GuardLogix, ControlLogix, Compact Logix, and Compact GaurdLogix controllers Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this...

CVE-2022-44756 HCL BigFix Insights for Vulnerability Remediation (IVR) is vulnerable to improper input validation

Insights for Vulnerability Remediation IVR is vulnerable to improper input validation. This may lead to information disclosure. This requires privileged access...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the getFact function due to improper input sanitization. PoC js var root = require"puppet-facter" root.getFact"& touch JHU",function, Remediation There is no fixed version for puppet-facter. References - Vulnerable...

Command Injection

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Command Injection via the getRemotePackageInfo function due to improper input sanitization. PoC js var root = require"get-global-packages" root.getRemotePackageInfo"name":"& touch JHU &"...

Input validation

Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG OTRS Community Edition allows SQL Injection via TicketSearch Webservice This issue affects OTRS: from 7.0.1 before 7.0.40 Patch 1, from 8.0.1 before 8.0.28 Patch 1; OTRS Community Edition: from 6.0.1 through 6.0.34...

CVE-2022-4427 SQL Injection via OTRS Search API

Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG OTRS Community Edition allows SQL Injection via TicketSearch Webservice This issue affects OTRS: from 7.0.1 before 7.0.40 Patch 1, from 8.0.1 before 8.0.28 Patch 1; OTRS Community Edition: from 6.0.1 through 6.0.34...

CVE-2022-4427

CVE-2022-4427 : An SQL injection via the TicketSearch Webservice affects OTRS/OTRS Community Edition due to improper input validation. Affected: OTRS 7.0.1–7.0.39 (Patch 1 not included), 8.0.1–8.0.27 (Patch 1 not included); Community Edition 6.0.1–6.0.34. Remediation (as per sources): upgrade to ...

PT-2022-25505 · Apache · Apache Traffic Server

Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions 9.0.0 through 9.1.3 Description: The issue is related to an Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server, which can lead to cross site scripti...

CVE-2022-42521

In encode of wlandata.cpp, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:...

CVE-2022-20543

In multiple locations, there is a possible display crash loop due to improper input validation. This could lead to local denial of service with system execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-238178261...

Out-of-bounds

In secsysmmuinfo of drmfw.c, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:...

Out-of-bounds

In StringsRequestData::encode of requestdata.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...

Design/Logic Flaw

In ppmpunprotectmfcfwbuf of drmfw.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...

Input validation

In trustyffamemreclaim of shared-mem-smcall.c, there is a possible privilege escalation due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2022-20585

In validoutofspecialsecdramaddr of drmaccesscontrol.c, there is a possible EoP due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...

CVE-2022-20584

In pagenumber of sharedmem.c, there is a possible code execution in secure world due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...

CVE-2022-42544

In getView of AddAppNetworksFragment.java, there is a possible way to mislead the user about network add requests due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2022-20592

CVE-2022-20592 describes a vulnerability in the Android kernel’s DRM firmware, specifically in the function ppmp_validate_secbuf of drm_fw.c. The flaw stems from improper input validation, allowing local information disclosure without requiring additional execution privileges or user interaction....

CVE-2022-42510

In StringsRequestData::encode of requestdata.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...