PT-2022-26110

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 4.10.19 Parse Server versions prior to 5.3.2 Description The issue allows keywords specified in the requestKeywordDenylist option to be injected via Cloud Code Webhooks or Triggers, resulting in the keyword being...

device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an abstract Unix socket

A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath...

CVE-2022-41974

A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath...

CVE-2022-40447

ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the keyword parameter at /admin/baojialist.php...

Sql injection

ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the keyword parameter at /admin/baojialist.php...

CVE-2022-40447

ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the keyword parameter at /admin/baojialist.php...

CVE-2022-40447

CVE-2022-40447 affects ZZCMS 2022 with a SQL injection in the admin/baojia_list.php endpoint through the keyword parameter. The vulnerability is described as an SQL injection (concrete vulnerable vector: keyword parameter) and is rated with CVSS 3.1: 7.2 (HIGH) with network attack vector, low att...

PT-2022-25390 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2022 Description: The issue is related to a SQL injection vulnerability. It occurs via the keyword parameter at the "/admin/baojia list.php" API endpoint. Recommendations: For ZZCMS version 2022, avoid using the keyword paramete...

CVE-2022-3242 HTML code Injection in template search keyword in microweber/microweber

Code Injection in GitHub repository microweber/microweber prior to 1.3.2...

CVE-2022-1580

The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature...

CVE-2022-36085

A flaw was found in open-policy-agent. The Rego compiler provides a deprecated WithUnsafeBuiltins function, allowing users to provide a set of built-in functions that should be deemed unsafe and rejected by the compiler if encountered in the policy compilation stage. A bypass of this protection c...

Open Policy Agent 安全漏洞

Open Policy Agent is an open source, general-purpose policy engine that enables uniform, context-aware policy enforcement across the stack. A security vulnerability exists in Open Policy Agent OPA that stems from the use of the with keyword to bypass WithUnsafeBuiltins to emulate functions...

CVE-2022-2541

The uContext for Amazon plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 3.9.1. This is due to missing nonce validation in the /app/sites/ajax/actions/keywordsave.php file that is called via the doAjax function. This makes i...

CVE-2022-2542

The uContext for Clickbank plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 3.9.1. This is due to missing nonce validation in the /app/sites/ajax/actions/keywordsave.php file that is called via the doAjax function. This make...

PT-2022-17273

Name of the Vulnerable Software and Affected Versions uContext for Amazon plugin for WordPress versions up to, and including 3.9.1 Description The issue is related to Cross-Site Request Forgery to Cross-Site Scripting due to missing nonce validation in the /app/sites/ajax/actions/keyword save.php...

gomatrixserverlib 安全漏洞

gomatrixserverlib is a Go library open-sourced by matrix.org. Used for common functions required by the matrix server. A security vulnerability exists in gomatrixserverlib, which stems from the inability of its power level parsing program to parse the "eventsdefault" keyword of the...

CVE-2022-35121

Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java...

CVE-2022-35121

Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java...

CVE-2022-35121

Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java...

CVE-2022-35121

CVE-2022-35121 affects Novel-Plus v3.6.1 with a SQL injection via the keyword parameter on the endpoint /service/impl/BookServiceImpl.java. The NVD entry lists a CVSS v3.1 base score of 9.8 (CRITICAL) with network attack vector, no privileges required, and user interaction not needed; impact is H...