CVE-2022-24843

Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin 2.50 has arbitrary file read vulnerability due to a lack of parameter validation. This has been resolved in version 2.5.1. There are no known workarounds for th...

Arbitrary File Upload

express-fileupload is vulnerable to arbitrary file upload. The vulnerability exists due to a lack of verification of the number of files being sent to the writeStream function...

PT-2022-16917

Name of the Vulnerable Software and Affected Versions Gin-vue-admin versions 2.50 Description Gin-vue-admin is a backstage management system based on vue and gin. The issue arises due to a lack of parameter validation, leading to an arbitrary file read vulnerability. There are no known workaround...

CVE-2022-24843: Improper Limitation of a Pathname to a Restricted Directory

Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin 2.50 has arbitrary file read vulnerability due to a lack of parameter validation. This has been resolved in version 2.5.1. There are no known workarounds for th...

PT-2025-8471

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A issue in the Linux kernel has been identified where the input dev can be unregistered while calling snd jack report when using ASoC, leading to a NULL pointer dereference. This occurs...

Chris Brame Trudesk 代码问题漏洞

Chris Brame Trudesk is an open source helpdesk/ticketing solution from Chris Brame USA. A code issue vulnerability vulnerability exists in versions prior to Chris Brame Trudesk 1.2.0 that stems from a lack of filtering and escaping in the svg file upload function...

CVE-2021-25090: Improper Neutralization of Input During Web Page Generation

The Portfolio Gallery, Product Catalog WordPress plugin before 2.1.0 does not have authorisation and CSRF checks in various functions related to AJAX actions, allowing any authenticated users, such as subscriber, to call them. Due to the lack of sanitisation and escaping, it could also allows...

PT-2022-9646

Name of the Vulnerable Software and Affected Versions The Portfolio Gallery, Product Catalog WordPress plugin versions prior to 2.1.0 Description The issue concerns a lack of authorization and CSRF checks in various functions related to AJAX actions, allowing any authenticated users to call them...

Rockwell Automation Connected Components Workbench CCWARC File Parsing Deserialization Of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Rockwell Automation Connected Components Workbench. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific fl...

Access Control Bypass

IBM MQ is vulnerable to access control bypass. The vulnerability exists due to a lack of sanitization between a valid and an invalid login attempts allowing an attacker to enumerate account credentials...

Tipsacarrier <= 1.4.4.2 - Unauthenticated Orders Disclosure

The plugin does not have any authorisation check in place some functions, which could allow unauthenticated users to access Orders data which could be used to retrieve the client full address, name and phone via tracking URL Vendor was notified on November 26th, 2021, did not reply nor fix the...

Autodesk Navisworks Manage PDF File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autodesk Navisworks Manage. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Autodesk Navisworks Manage PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autodesk Navisworks Manage. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

PT-2022-10185

Name of the Vulnerable Software and Affected Versions AVEVA System Platform versions 2017 through 2020 R2 P01 Description The issue concerns the lack of authentication for certain functionality that requires a provable user identity. Recommendations For AVEVA System Platform versions 2017 through...

PT-2022-9668

Name of the Vulnerable Software and Affected Versions Dropdown Menu Widget WordPress plugin versions 1.9.7 and earlier Description The issue concerns a lack of authorisation and CSRF checks when saving settings, allowing low-privilege users to update them. Additionally, the lack of sanitisation a...

(0Day) Array Networks MotionPro Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Array Networks MotionPro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

PT-2022-9604

Name of the Vulnerable Software and Affected Versions KingComposer WordPress plugin versions prior to 2.9.7 Description The issue concerns a lack of proper authorization, CSRF protection, and input sanitization/escaping in the KingComposer WordPress plugin. This allows any authenticated user to...

Design/Logic Flaw

Sensitive information can be obtained through the handling of serialized data. The issue results from the lack of proper authentication required to query the server...

CVE-2020-14479

CVE-2020-14479 affects Inductive Automation Ignition (Gateway) with a vulnerability described as missing authentication for a critical function, leading to information disclosure via serialized data handling. Affected products include Ignition Gateway versions prior to 7.9.14 (7.x line) and prior...

PT-2022-8567

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned. Description The issue allows sensitive information to be obtained through the handling of serialized data due to the lack of proper authentication required to query the server. Recommendations At...