CVE-2022-41158

Eyoom Builder (Eyoom) contains a path traversal/remote code execution flaw. Affects versions prior to 4.5.4; vulnerability arises from using cookie values as file paths, enabling remote attackers to execute or inject code. Reported across multiple feeds (CNNVD/CVE entries). Remediation cited: upd...

GHSA-6X99-GV2V-Q76V FPE in `tf.image.generate_bounding_box_proposals`

Impact When running on GPU, tf.image.generateboundingboxproposals receives a scores input that must be of rank 4 but is not checked. python import tensorflow as tf a = tf.constantvalue=1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0 b = tf.constantvalue=1...

qt: QProcess could execute a binary from the current working directory when not found in the PATH

A flaw was found in qt. The vulnerability occurs due to executing binaries from the current directory when the loading path failed, leading to an uncontrolled path element vulnerability. This flaw allows an attacker to execute malicious executables...

The vulnerability of the installation file of the Kaspersky Endpoint Security antivirus software and the Kavremover utility allows a malicious actor to execute an external executable file from within the installation process.

The vulnerability of the installation file of Kaspersky Endpoint Security and the Kavremover utility is related to an uncontrolled element in the search path. Exploiting this vulnerability could allow a malicious actor to execute an external executable file from within the installation process...

CVE-2021-3305

Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discovered to contain an untrusted search path vulnerability...

CVE-2021-3305

Feishu (Beijing Feishu Technology Co.) v3.40.3 is affected by an untrusted search path vulnerability. The CVE-2021-3305 entry indicates a LOCAL, LOW-ATTACK-CURVE issue with HIGH impact across confidentiality, integrity, and availability, with a CVSSv3.1 base score of 7.8 and UI interaction requir...

GHSA-HHQ3-FF78-JV3G loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)

A regular expression denial of service ReDoS flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils via the resourcePath variable in interpolateName.js. A badly or maliciously formed string could be used to send crafted requests that cause a system to crash or ta...

Simple Cold Storage Management System SQL注入漏洞

Sourcecodester Simple Cold Storage Management System is a web-based application used as a cold storage business website to provide their customers or prospects with an easily accessible platform to learn about their company. A SQL injection vulnerability exists in Simple Cold Storage Management...

python: open redirection vulnerability in lib/http/server.py may lead to information disclosure

A vulnerability was found in python. This security flaw causes an open redirection vulnerability in lib/http/server.py due to no protection against multiple / at the beginning of the URI path. This issue may lead to information disclosure...

The vulnerability of the LD_LIBRARY_PATH environment variable allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the LDLIBRARYPATH environment variable in the GNU C Library is related to operations that go beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker to access confidential data, compromise its integrity, and cause service failures...

Google KFM 跨站脚本漏洞

Google KFM is an ajax file browser and manager from Google, Inc. A security vulnerability exists in Google KFM that stems from a cross-site scripting XSS vulnerability that can be triggered via a crafted GET request to /kfm/index.php...

CVE-2022-36403

The CVE-2022-36403 issue affects Ricoh Device Software Manager installer up to version 2.20.3.0. The root cause is an untrusted search path that may cause insecure loading of DLLs (CWE-427), potentially allowing arbitrary code execution with the installer user’s privileges. Public documents consi...

CVE-2022-36344

CVE-2022-36344 describes an unquoted search path vulnerability in JustSystems JUST Online Update for J-License, bundled with various corporate products (Ichitaro through Pro5 and others). The root cause is an unquoted file path used to start a secondary program from the Windows service, enabling ...

Online Tours And Travels Management System SQL注入漏洞

Online Tours And Travels Management System is an online travel management system by Carlo Montero, an individual developer. A security vulnerability exists in Online Tours And Travels Management System v1.0, which can be exploited by an attacker to perform SQL injection using the pname parameter ...

Design/Logic Flaw

Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation, allowing attackers with Item/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system...

CVE-2022-32129

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting XSS vulnerability via the path /company/account/safety/trade...

CVE-2022-32127

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting XSS vulnerability via the path /company/viewbebrowsed/total...

CVE-2022-32128

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting XSS vulnerability via the path /company/service/increment/add/im...

Cross site scripting

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting XSS vulnerability via the path /company/downresume/total/nature...

74cms 跨站脚本漏洞

74cms is a PHP and MySQL-based online recruitment system from China Xunyi Technology Company. 74cms version v3.5.1 contains a cross-site scripting vulnerability, which originates from the path /index/jobfairol/show/ lack of data validation filtering for user-supplied data and output. An attacker...