GHSA-P64X-8RXX-WF6Q Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc and Extract database functions are subject to SQL injection if untrusted data is used as a kind/lookupname value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected...

CVE-2022-2287

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0...

AZL-10015 CVE-2022-2285 affecting package vim for versions less than 9.0.0050-2

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0...

CVE-2022-2285

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0...

Vim 安全漏洞

Vim is a cross-platform text editor. A security vulnerability exists in versions prior to Vim 9.0 that stems from the presence of a heap-based buffer overflow...

ALPINE-CVE-2022-2264

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0...

CVE-2022-2264

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0...

AZL-10013 CVE-2022-2257 affecting package vim for versions less than 9.0.0050-2

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0...

CVE-2017-20124

A vulnerability classified as critical has been found in Online Hotel Booking System Pro Plugin 1.0. Affected is an unknown function of the file /front/roomtype-details.php. The manipulation of the argument tid leads to sql injection. It is possible to launch the attack remotely. The exploit has...

CVE-2021-3779

A malicious MySQL server can request local file content from a client using ruby-mysql prior to version 2.10.0 without explicit authorization from the user. This issue was resolved in version 2.10.0 and later...

UBUNTU-CVE-2021-40607

The schmboxsize function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command...

GLPI 信息泄露漏洞

GLPI is an open source IT and asset management software. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridges and ink cartridges. An...

CVE-2022-21829

Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing ‘concretesecure’ instead of ‘concrete’. Concrete now only makes requests over https even a request comes in via http...

Prison Management System SQL注入漏洞

Prison Management System is a prison management system by Carlo Montero's personal developer. v1.0 of Prison Management System is vulnerable to SQL injection, which originates from the application /pms/admin/inmates/managerecord. php in the id parameter lack of SQL data filter escaping, an attack...

CVE-2022-31374

An arbitrary file upload vulnerability /images/background/1.php in of SolarView Compact 6.0 allows attackers to execute arbitrary code via a crafted php file...

CVE-2022-22317

IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 218281...

FreeBSD 资源管理错误漏洞

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. A resource management error vulnerability exists in versions of FreeBSD prior to 7.0 that stems from improper handling of TSopt for TCP connections...

Vulnerabilities fixed in Adobe Bridge

Adobe has fixed several vulnerabilities in Bridge. A malicious party could exploit the vulnerabilities to execute arbitrary code in the context of the application, or to access gain access to sensitive data in the context of the application. To do this, the malicious party must trick the victim...

CVE-2022-32350

The CVE-2022-32350 entry concerns the Hospital’s Patient Records Management System v1.0, which is vulnerable to SQL Injection via the endpoint /hprms/classes/Master.php?f=delete_room_type. The root cause, as described across sources, is lack of input validation for SQL statements on that page, en...

PT-2022-20733 · Itop +1 · Itop +1

Name of the Vulnerable Software and Affected Versions: ITOP version 3.0.1 Description: A cross-site scripting XSS issue was found in ITOP. The vulnerability can be exploited via the "/itop/pages/ajax.render.php" API endpoint. Recommendations: For ITOP version 3.0.1, as a temporary workaround,...