CVE-2022-3333

A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Affected is an unknown function of the file /v1/tasks/create/ of the component REST Call Handler. The manipulation of the argument onanimationstart leads to cross site scripting. It is possible ...

CVE-2022-38061 WordPress Export Post Info plugin <= 1.2.0 - Authenticated CSV Injection vulnerability

Authenticated author+ CSV Injection vulnerability in Export Post Info plugin = 1.2.0 at WordPress...

CVE-2022-38703

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in Max Foundry Button Plugin MaxButtons plugin = 9.2 at WordPress...

GHSA-JQ8C-J47C-VVWM Apache SOAP's RPCRouterServlet allows reading of arbitrary files over HTTP

An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versions are also affected. NOTE: This...

CVE-2022-2266

University Library Automation System developed by Yordam Bilgi Teknolojileri before version 19.2 has an unauthenticated Reflected XSS vulnerability. This has been fixed in the version 19.2...

CVE-2022-40705

An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versions are also affected. NOTE: This...

Pydio 跨站脚本漏洞

Pydio AjaXplorer is a web-based remote file manager from Pydio. The manager supports uploading and downloading files, online file editing, image previewing, and more. A security vulnerability exists in Pydio version 4.2.3, which can be exploited by an attacker to cause a cross-site scripting...

PT-2022-24419 · Coreshield · Coreshield One-Way Gateway

Name of the Vulnerable Software and Affected Versions: CoreShield One-Way Gateway OWG Software versions prior to V2.2 Description: A security issue has been identified where the default installation of the software sets insecure file permissions. This could allow a local attacker to escalate...

mariadb: server crash in Item_args::walk_args

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Itemargs::walkargs...

多款 ZITADEL 产品 安全漏洞

ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the age of containers and serverless, open sourced by ZITADEL in Switzerland. ZITADEL suffers from a security vulnerability that stems from a lack of authorization checks, where Actions is abl...

PT-2022-23473 · Wamp · Wamp

Name of the Vulnerable Software and Affected Versions: Wamp versions 3.2.6 and below Description: The issue is related to incorrect access control in the install directory of Wamp, allowing authenticated attackers to execute arbitrary code by overwriting binaries in the directory. Recommendations...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the getle32 function in bele.h via a crafted Mach-O file. Remediation Upgrade upx to version 4.2.1 or higher. References - GitHub Commit - GitHub Issue Credit: giantbranch of NSFOCUS Security Team...

CVE-2022-2378

The Easy Student Results WordPress plugin through 2.2.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

CVE-2022-2713

Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0...

Synology DiskStation Manager 操作系统命令注入漏洞

Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology Inc. of Taiwan, China. This operating system manages information such as data, files, photos, music, and more. An operating system command injection vulnerability exists in Synology...

Trend Micro VPN Proxy Pro 安全漏洞

Trend Micro VPN Proxy Pro is one of the best virtual private network services from Trend Micro. A security vulnerability exists in Trend Micro VPN Proxy Pro version 5.2.1026 and prior versions. A local attacker could exploit the vulnerability to gain elevation of privilege on affected systems...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the core interpreter of sqclass.cpp, which may lead to Arbitrary Code Execution if a victim executes an attacker-controlled squirrel script. Remediation Upgrade squirrel to version 3.2 or higher. References - GitH...

mariadb: segmentation fault in Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exectimetracker::getloops/Filesorttracker::reportuse/filesort...

Veritas NetBackup 安全漏洞

Veritas NetBackup is a storage service from Veritas, Inc. that is used to provide backup and recovery capabilities for enterprise environments. The software supports ransomware detection and backup protection of environmental data such as metadata and virtual environments. A security vulnerabilit...

CVE-2022-21575

Vulnerability in the Oracle WebCenter Sites Support Tools product of Oracle Fusion Middleware component: User Interface. The supported version that is affected is Prior to 4.4.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...