CVE-2022-32524

CVE-2022-32524 affects Schneider Electric IGSS Data Server (IGSSdataServer.exe) prior to version 15.0.0.22170. The root cause is a CWE-120: Buffer Copy without Checking Size of Input, leading to a stack-based buffer overflow. This could enable remote code execution when an attacker sends speciall...

CVE-2022-32527

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted alarm cache data messages. Affected Products: IGSS Data Server - IGSSdataServer.exe...

CVE-2023-24493

A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could leverage the reporting system to export reports containing formulas, which would then require a victim to approve and execute on a...

CVE-2023-22491 gatsby-transformer-remark vulnerable to unsanitized JavaScript code injection

Gatsby is a free and open source framework based on React that helps developers build websites and apps. The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the gray-matter npm package, which is vulnerable to JavaScript injection in its default...

CVE-2022-45051

A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The module parameter on the Service.template.cls endpoint does not properly neutralise user input, resulting in the vulnerability...

CVE-2022-45051 Reflected POST XSS in Axiell Iguana CMS

A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The module parameter on the Service.template.cls endpoint does not properly neutralise user input, resulting in the vulnerability...

CVE-2022-43602

Multiple code execution vulnerabilities exist in the IFFOutput::close functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability...

CVE-2022-43468

External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore the vulnerable product accepts untrusted external inputs to update certain internal variables. As a result, the number of views for an article may be manipulate...

SEPPmail 跨站脚本漏洞

SEPPmail is an email encryption and signature solution from the Swiss company SEPPmail. SEPPmail suffers from a cross-site scripting vulnerability that originates from a web front-end user input that is not properly embedded in a web page. An attacker could exploit this vulnerability to conduct a...

Team Johnlong software Raiden MAILD Mail Server 跨站脚本漏洞

Team Johnlong software Raiden MAILD Mail Server is a mail server software from China Village Rong Information Team Johnlong software Company. A security vulnerability exists in Team Johnlong software Raiden MAILD Mail Server versions prior to v4.7.4, which stems from insufficient filtering of use...

CVE-2022-41909

TensorFlow is an open source platform for machine learning. An input encoded that is not a valid CompositeTensorVariant tensor will trigger a segfault in tf.rawops.CompositeTensorVariantToComponents. We have patched the issue in GitHub commits bf594d08d377dc6a3354d9fdb494b32d45f91971 and...

CVE-2022-20969

A vulnerability in multiple management dashboard pages of Cisco Umbrella could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the Cisco Umbrella dashboard. This vulnerability is due to unsanitized user input. An attacker could exploit this...

Tenda AX1803 缓冲区错误漏洞

Tenda AX1803 is a dual-band Gigabit WIFI6 router from Tenda China. A security vulnerability exists in Tenda AX1803 v1.0.0.1, which stems from a http request processed by the fromAdvSetMacMtuWan function, wanSpeed, cloneType, mac can cause a stack overflow and enable Remote Code Execution RCE...

CVE-2022-22228

Juniper Junos OS rpd (routing protocol daemon) is affected by CVE-2022-22228 due to improper validation of input, causing a memory leak that can lead to a DoS when IPv6 packets are sent to configured addresses. Affected releases include 21.1 before 21.1R3-S2; 21.2 before 21.2R3-S1; 21.3 before 21...

Academy Learning Management System 跨站脚本漏洞

Academy Learning Management System is an Academy Learning Management System from the Creativeitem team. The vulnerability is caused by the lack of effective filtering and escaping of user-supplied data in the Search parameter, which could be exploited to launch a reflective cross-site scripting...

CVE-2022-37395

A Huawei device has an input verification vulnerability. Successful exploitation of this vulnerability may lead to DoS attacks.Affected product versions include:CV81-WDM FW versions 01.70.49.29.46...

Stack overflow

TensorFlow is an open source platform for machine learning. The ScatterNd function takes an input argument that determines the indices of of the output tensor. An input index greater than the output tensor or less than zero will either write content at the wrong index or trigger a crash. We have...

CVE-2022-37796

In Simple Online Book Store System 1.0 in /adminbook.php the Title, Author, and Description parameters are vulnerable to Cross Site ScriptingXSS...

DEBIAN-CVE-2022-2613

Use after free in Input in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to enage in specific user interactions to potentially exploit heap corruption via specific UI interactions...

easy to craft input to execute commands that are not SELECTOR_TRANSFER_OPERATORSHIP

Lines of code Vulnerability details Impact For AxelarGateway.execute , the signed messageHash is only used to validateProof for currentOperators , so anyone can craft input to execute commands other than SELECTORTRANSFEROPERATORSHIP. Impact of above would allow anyone to be able to be approved to...