January 26, 2023—KB5022360 (OS Build 22621.1194) Preview

None None...

simple-git 安全漏洞

simple-git is a lightweight interface for running git commands in any node.js application. A security vulnerability exists in simple-git prior to version 3.16.0, which stems from the clone, pull, push, and listRemote methods not being properly cleaned up and escaped...

smartctl 安全漏洞

smartctl is a command line application by Manuel B. Personal Developer. A security vulnerability exists in smartctl that stems from incorrect input cleanup, which can be exploited by an attacker to perform command injection via the info method...

CVE-2022-21810

All versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization...

PT-2023-12672 · Smartctl · Smartctl

Name of the Vulnerable Software and Affected Versions: smartctl versions all Description: The issue is related to Command Injection via the info method due to improper input sanitization. This allows for potential exploitation. No information is provided about the estimated number of potentially...

Inout Search Engine 10.1.3 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

The vulnerability of the utils.exec build method of the Nginx Proxy Manager web proxy server allows a hacker to execute arbitrary commands on the server.

The vulnerability of the utils.exec build method of the Nginx Proxy Manager proxy server exists because measures to eliminate special elements used in operating system commands have not been taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands on the server...

Oracle Linux 9 : postgresql-jdbc (ELSA-2023-0318)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-0318 advisory. - fix for CVE-2022-31197 Tue Aug 10 2021 Mohan Boddu Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Not...

Pgpool-II vulnerable to information disclosure

Overview Pgpool-II is cluster management tool. Pgpool-II contains an information disclosure vulnerability CWE-200 in its watchdog function. Note that, only systems that meet all of the following setting requirements are affected by this vulnerability. Watchdog function is enabled usewatchdog = on...

RHEL 7 : python27 (RHSA-2020:4273)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4273 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

RHEL 7 : rh-python38 (RHSA-2020:4299)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4299 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

Vulnerability of the PM_io parser function: <PMDEC>::read_hedge() -> set_next(). This component is located in the Nef_2/PM_io parser.h file, which belongs to the CGAL algorithm library. It allows an attacker to access confidential data, compromise its integrity, and also cause service failures.

The vulnerability of the PMioparser function in the Nef2/PMio parser component’s readhedge method is related to unvalidated array indexing. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures through a speciall...

PT-2023-2888 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader versions 12.02 through 12.1.0 Description: This issue allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability, where the targ...

Cross-Site Request Forgery (CSRF)

apache-superset is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists due to the use of the HTTP GET method for the legacy REST API endpoints in the requestaccess and approve functions of core.py, allowing an attacker to redirect to the malicious URL through the GET request...

GHSA-J6GC-792M-QGM2 ReDoS based DoS vulnerability in Active Support's underscore

There is a possible regular expression based DoS vulnerability in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-22796. Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 Rails LTS, which is a paid service and not part of the rubygem, 6.1.7.1,...

Insecure Temporary File

globalpomutils-fileresources is vulnerable to Insecure Temporary Files. The vulnerability exists due to the File.createTempFile function in the createTmpDir method of FileResourceManagerProvider.java, which creates a temporary directory with default permissions. This directory has READ all...

PT-2023-18702 · Ruby +5 · Ruby +5

Name of the Vulnerable Software and Affected Versions: Active Support versions prior to 6.1.7.1 Active Support versions prior to 7.0.4.1 Description: The issue is related to insufficient input validation in the Inflector.underscore method, which can lead to a regular expression based DoS...

DEBIAN-CVE-2023-22727

CakePHP is a development framework for PHP web apps. In affected versions the Cake\Database\Query::limit and Cake\Database\Query::offset methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to...

UBUNTU-CVE-2023-22727

CakePHP is a development framework for PHP web apps. In affected versions the Cake\Database\Query::limit and Cake\Database\Query::offset methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to...

GSD-2023-1001569 ACPICA: Fix error code path in acpi_ds_call_control_method()

ACPICA: Fix error code path in acpidscallcontrolmethod This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.337 by commit...