NewStart CGSL MAIN 6.02 : expat Multiple Vulnerabilities (NS-SA-2022-0104)

The remote NewStart CGSL host, running version MAIN 6.02, has expat packages installed that are affected by multiple vulnerabilities: - In Expat aka libexpat before 2.4.5, an attacker can trigger stack exhaustion in buildmodel via a large nesting depth in the DTD element. CVE-2022-25313 - In Expa...

ctrlo lenio 安全漏洞

lenio is an open source facility management system from ctrlo. A security vulnerability exists in ctrlo lenio, which stems from an unknown function in the file views/layouts/main.tt of its Notice Handler component that operates on the parameter notice.notice.text allowing an attacker to implement...

CVE-2020-4497

IBM Spectrum Protect Plus 10.1.0 through 10.1.12 discloses sensitive information due to unencrypted data being used in the communication flow between Spectrum Protect Plus vSnap and its agents. An attacker could obtain information using main in the middle techniques. IBM X-Force ID: 182106...

CVE-2020-4497 IBM Spectrum Protect Plus information disclosure

IBM Spectrum Protect Plus 10.1.0 through 10.1.12 discloses sensitive information due to unencrypted data being used in the communication flow between Spectrum Protect Plus vSnap and its agents. An attacker could obtain information using main in the middle techniques. IBM X-Force ID: 182106...

PT-2022-6327 · D Link · D-Link Dir-859 A1

Name of the Vulnerable Software and Affected Versions: D-Link DIR-859 A1 version 1.05 Description: The issue is related to a command injection vulnerability in the soapcgi main function of the D-Link DIR-859 A1 router's firmware. This vulnerability can be exploited by a remote attacker to execute...

Design/Logic Flaw

Discourse is an open-source discussion platform. In version 2.8.13 and prior on the stable branch and version 2.9.0.beta14 and prior on the beta and tests-passed branches, any authenticated user can create an unlisted topic. These topics, which are not readily available to other users, can take u...

CVE-2022-46159 Any authenticated Discourse user can create an unlisted topic

Discourse is an open-source discussion platform. In version 2.8.13 and prior on the stable branch and version 2.9.0.beta14 and prior on the beta and tests-passed branches, any authenticated user can create an unlisted topic. These topics, which are not readily available to other users, can take u...

PT-2022-6326 · D Link · D-Link Dir-645

Name of the Vulnerable Software and Affected Versions: D-Link DIR 645A1 version 1.06B01 Beta01 Description: The issue is related to a stack overflow in the genacgi main function, which can be triggered via the service= variable. This can potentially allow a remote attacker to cause a denial of...

TOTOLINK LR350 main function buffer overflow vulnerability

TOTOLINK LR350 is a 4G LTE router from China's Gion Electronics TOTOLINK that supports converting 4G signals to wired signals for home and office scenarios. A buffer overflow vulnerability exists in the TOTOLINK LR350. The vulnerability stems from a pre-authentication buffer overflow in the main...

CVE-2022-44255

TOTOLINK LR350 V9.3.5u.6369B20220309 contains a pre-authentication buffer overflow in the main function via long post data...

CVE-2022-44255

TOTOLINK LR350 V9.3.5u.6369B20220309 contains a pre-authentication buffer overflow in the main function via long post data...

Design/Logic Flaw

TOTOLINK LR350 V9.3.5u.6369B20220309 contains a pre-authentication buffer overflow in the main function via long post data...

TOTOLINK LR350 缓冲区错误漏洞

TOTOLINK LR350 is a 4G LTE router from China's Gion Electronics TOTOLINK that supports converting 4G signals to wired signals for home and office scenarios. A buffer overflow vulnerability exists in the TOTOLINK LR350. The vulnerability stems from a pre-authentication buffer overflow in the main...

PT-2022-27154 · Totolink · Totolink Lr350

Name of the Vulnerable Software and Affected Versions: TOTOLINK LR350 version 9.3.5u.6369 B20220309 Description: The issue is a pre-authentication buffer overflow in the main function, which can be triggered via long post data. Recommendations: For TOTOLINK LR350 version 9.3.5u.6369 B20220309,...

CVE-2022-44255

Totolink LR350 with firmware 9.3.5u.6369_B20220309 contains a pre-authentication buffer overflow in the main function that can be triggered by long POST data. The issue is network-accessible and does not require authentication; provenance in the sources indicates potential for remote code executi...

CVE-2022-41937 Missing Authorization in XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The application allows anyone with view access to modify any page of the wiki by importing a crafted XAR package. The problem has been patched in XWiki 14.6RC1, 14.6 and 13.10.8. As a...

CVE-2022-41611

Cross-site Scripting XSS vulnerability in BlueSpiceDiscovery skin of BlueSpice allows user with admin privileges to inject arbitrary HTML into the main navigation of the application...

CVE-2022-41611

Cross-site Scripting XSS vulnerability in BlueSpiceDiscovery skin of BlueSpice allows user with admin privileges to inject arbitrary HTML into the main navigation of the application...

CVE-2022-41611 Potential XSS on sidebar navigation

Cross-site Scripting XSS vulnerability in BlueSpiceDiscovery skin of BlueSpice allows user with admin privileges to inject arbitrary HTML into the main navigation of the application...

BlueSpice 跨站脚本漏洞

BlueSpice is free Wiki software from BlueSpice based on the MediaWiki engine. A cross-site scripting vulnerability exists in BlueSpice versions prior to 4.2.1 that stems from the presence of cross-site scripting XSS, which allows users with administrator privileges to inject arbitrary HTML into t...