CVE-2022-3346

DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. The owner name of RRSIG RRs is not validated, permitting an attacker to present the RRSIG for an attacker-controlled domain in a response for...

Gin-Vue-Admin 代码问题漏洞

Gin-Vue-Admin is a full-stack pre-development infrastructure platform based on Vue and Gin development. A code issue exists in Gin-Vue-Admin versions prior to 2.5.4, which stems from a validation of the fileMd5 and fileName parameters, which could lead to reading arbitrary files...

DEBIAN-CVE-2021-41803

HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."...

HashiCorp Consul 安全漏洞

HashiCorp Consul is a suite of distributed, highly available data center-aware solutions from HashiCorp USA. The product is used to connect and configure applications across dynamically distributed infrastructures. A security vulnerability exists in HashiCorp Consul versions 1.8.1, 1.11.81.12.4,...

PT-2022-11486 · Hashicorp +3 · Hashicorp Consul +3

Name of the Vulnerable Software and Affected Versions: HashiCorp Consul versions 1.8.1 through 1.11.8 HashiCorp Consul version 1.12.4 HashiCorp Consul version 1.13.1 Description: The issue arises from improper validation of node or segment names prior to their interpolation and usage in JWT claim...

GLSA-202208-15 : isync: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202208-15 isync: Multiple Vulnerabilities - A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially...

UBUNTU-CVE-2022-29154

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...

CVE-2022-29154

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...

Transposh WordPress Translation 1.0.8.1 Remote Code Execution

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Transposh WordPress Translation Vendor URL: https://wordpress.org/plugins/transposh-translation-filter-for-wordpress/ Type: Reliance on File Name or Extension of Externally-Supplied File...

OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor

Impact Due to insufficient class name validation in GrapeJS library it's possible to add executable JS code in class name through Selector Manager Relates to - https://github.com/artf/grapesjs/issues/4411 Patch Update GrapeJS dependency to =v0.19.5...

GHSA-6F85-3F8Q-QC94 OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor

Impact Due to insufficient class name validation in GrapeJS library it's possible to add executable JS code in class name through Selector Manager Relates to - https://github.com/artf/grapesjs/issues/4411 Patch Update GrapeJS dependency to =v0.19.5...

The vulnerability of clients for conducting real-time audio and video conferences via Zoom Client for Meetings on Android, iOS, Linux, macOS, and Windows lies in the improper validation of the host name during the server switching process. This allows attackers to execute a “man-in-the-middle” attack.

The vulnerability of clients for conducting real-time audio and video conferences using Zoom Client for Meetings on Android, iOS, Linux, macOS, and Windows stems from an improper check of the host name during the request to switch servers. Exploiting this vulnerability allows a remote attacker to...

Elcomplus LLC SmartICS 路径遍历漏洞

Elcomplus LLC SmartICS is a builder of top-level visualizations for industrial automation systems from Elcomplus LLC. A path traversal vulnerability exists in Elcomplus LLC SmartICS, which stems from inadequate validation of file names. An attacker could exploit this vulnerability to perform a pa...

CVE-2022-32156

In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface CLI did not validate TLS certificates while connecting to a remote Splunk platform instance by default. After updating to version 9.0, see Configure TLS host name validation for the Splunk CLI...

Rescue Dispatch Management System 安全漏洞

Rescue Dispatch Management System is a rescue dispatch management system developed by Carlo Montero. v1.0 of Rescue Dispatch Management System is vulnerable to an arbitrary file deletion vulnerability in /rdms/classes/ Master.php?f=deleteimg lacks valid validation for file names, which can be...

Online Car Wash Booking System 安全漏洞

Online Car Wash Booking System is an online car wash booking system by Carlo Montero. v1.0 of Online Car Wash Booking System is vulnerable to an arbitrary file deletion vulnerability in /ocwbs/classes/Master.php? f=deleteimg page lacks validation for file names, which can be exploited to cause...

CVE-2022-28783

CVE-2022-28783 concerns Galaxy Themes prior to Samsung SMR May-2022 Release 1, where improper validation allowed uninstalling arbitrary packages without permission. The description in multiple sources confirms the root cause as insufficient validation for removing a package name, enabling unautho...

MISP 跨站脚本漏洞

MISP is an open source software solution. The product is used to collect, store, distribute, and share network security metrics and has features such as threat network security event analysis and malware analysis. cross-site scripting vulnerability exists in versions prior to MISP 2.4.158, which...

OpenSSH < 8.0

According to its banner, the version of OpenSSH running on the remote host is prior to 8.0. It is, therefore, affected by the following vulnerabilities: - A permission bypass vulnerability due to improper directory name validation. An unauthenticated, remote attacker can exploit this, with a...

PT-2022-9771 · Genians · Genian Nac

Name of the Vulnerable Software and Affected Versions: Genian NAC affected versions not specified Description: A remote code execution issue was discovered due to a Server-Side Template Injection SSTI vulnerability and insufficient validation of the file name parameter. This allows remote attacke...