PT-2022-29056

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.27 Description A potential security issue exists due to a lack of validation of the debugfs dir pointer before its use in the iwlwifi mvm module. The actual impact and likelihood of a successful attack have...

PT-2022-28987

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.13 Description A potential security issue exists due to a lack of validation of the debugfs dir pointer before its use in the iwlwifi mvm module. The actual impact and likelihood of a successful attack have...

Information Disclosure

httpie is vulnerable to information disclosure. The vulnerability exists due to a lack of sanitization of cookies in persistent session allowing the cookies to be visible to all sites in that session...

CVE-2021-43957

Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References IDOR vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9...

CVE-2022-27197: Improper Neutralization of Input During Web Page Generation

Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure views...

Information Disclosure

freetakserverui is vulnerable to SQL injection. The vulnerability exists due to a lack of sanitization of the API endpoint...

PT-2022-9536

Name of the Vulnerable Software and Affected Versions Error Log Viewer WordPress plugin versions prior to 1.1.2 Description The issue allows high privilege users to clear arbitrary files on the web server, including those outside of the blog folder, due to a lack of validation of the log file pat...

PT-2022-15653

Name of the Vulnerable Software and Affected Versions The Simple Quotation WordPress plugin versions 1.3.2 and earlier Description The issue concerns a lack of authorization and CSRF checks in various AJAX actions, as well as insufficient escaping of user data in SQL statements. This allows any...

Autodesk AutoCAD PCX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autodesk AutoCAD. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PC...

(0Day) Ecava IntegraXor Inkscape EMF File Parsing Uninitialized Pointer Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Ecava IntegraXor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsi...

(0Day) Ecava IntegraXor Inkscape EMF File Parsing Out-Of-Bound Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Ecava IntegraXor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsi...

(0Day) Ecava IntegraXor Inkscape EMF File Parsing Out-Of-Bound Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ecava IntegraXor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EM...

Mozilla Firefox textPath Element Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mozilla Firefox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

Remote Code Execution (RCE)

jenkins-2-plugins is vulnerable to remote code execution. The vulnerability exists due to the lack of sanitization of the name of an image or a tag...

PT-2022-17606

Name of the Vulnerable Software and Affected Versions Power Line Communications PLC4TRUCKS J2497 trailer brake controllers affected versions not specified Description The issue concerns the lack of authentication or authorization for diagnostic functions in the Power Line Communications PLC4TRUCK...

Mattermost: Reflected XSS in OAuth complete endpoints

Reflected XSS vulnerabilities were discovered in several OAuth complete endpoints in Mattermost. These endpoints failed to sanitize the "redirectto" field in the "state" query parameter, allowing an attacker to execute malicious JavaScript code in the context of the user's browser. This could lea...

The vulnerability of the Apache ShenYu software lies in the lack of authorization for critical functions, allowing attackers to circumvent established security restrictions.

The vulnerability of the Apache ShenYu software lies in the lack of authentication for a critical function. Exploiting this vulnerability allows a malicious actor to circumvent established security restrictions remotely...

Maxsite CMS arbitrary file deletion vulnerability

MaxSite CMS is a web content management system of the Russian MaxSite CMS open source project . Maxsite CMS has arbitrary file deletion vulnerability , the vulnerability stems from all-files-update-ajax.php in the dir and deletefile parameters for the file name lack of validation , the attacker c...

Home Owners Collection Management System 代码问题漏洞

Home Owners Collection Management System is a homeowners collection management system. A security vulnerability exists in Home Owners Collection Management System v1.0, which stems from a lack of filters and restrictions on uploaded files. This allows an attacker to execute arbitrary code via a...

JetBrains Hub server-side request forgery vulnerability

JetBrains Hub is a web-based application from JetBrains Czech Republic. JetBrains Hub has a server-side request forgery vulnerability that stems from the software's lack of validation for request forgery, which can be exploited by attackers to conduct server-side request forgery SSRF attacks...