4044 matches found
CVE-2022-32193
Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor...
PT-2022-21372 · Couchbase · Couchbase Server
Name of the Vulnerable Software and Affected Versions: Couchbase Server versions prior to 7.0.4 Description: An issue was discovered in Couchbase Server where XDCR lacks role checking when changing internal settings. Recommendations: For versions prior to 7.0.4, update to version 7.0.4 or later t...
Couchbase Server 安全漏洞
Couchbase Server is a distributed NoSQL non-relational database from Couchbase USA, which primarily supports data query, full-text search, and active global replication. information disclosure vulnerability exists in versions of Couchbase Server prior to 7.0.4, which stems from the fact that samp...
LibreHealth EHR 跨站脚本漏洞
LibreHealth EHR is a clinically-focused electronic health record EHR system designed to be both easy to use out of the box and customizable for use in a variety of healthcare settings.LibreHealth EHR 2.0.0 is vulnerable to a cross-site scripting vulnerability for which no detailed vulnerability...
CVE-2022-32011
Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/applicants/index.php?view=view&id=...
Online Car Wash Booking System SQL注入漏洞
Online Car Wash Booking System is an online car wash booking system by Carlo Montero, a personal developer. Online Car Wash Booking System v1.0 is vulnerable to SQL injection, which originates from /ocwbs/admin/vehicles/ managevehicle.php?id=The page lacks validation for external input SQL...
Ascensio System ONLYOFFICE Document Server 缓冲区错误漏洞
Ascensio System ONLYOFFICE Document Server is an online office collaboration suite from Ascensio System, Latvia. The product supports viewing and editing of text, spreadsheets and presentations, among other things. A security vulnerability exists in Onlyoffice Document Server version v6.0.0 and...
EGavilan Media Contact-Form-With-Messages-Entry-Management SQL注入漏洞
EGavilan Media Contact-Form-With-Messages-Entry-Management is a simple contact form system from EGavilan Media. EGavilan Media Contact-Form-With-Messages-Entry -Management version 1.0 contains a SQL injection vulnerability that stems from vulnerability to SQL injection attacks via Addmessage.php....
mysql: InnoDB unspecified vulnerability (CPU Oct 2021)
Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.35 and prior and 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...
CVE-2022-31648
Talend Administration Center is vulnerable to a reflected Cross-Site Scripting XSS issue in the SSO login endpoint. The issue is fixed for versions 8.0.x in TPS-5233, for versions 7.3.x in TPS-5324, and for versions 7.2.x in TPS-5235. Earlier versions of Talend Administration Center may also be...
HashiCorp go-getter 输入验证错误漏洞
HashiCorp go-getter is a library for HashiCorp's Go golang for downloading files or directories from various sources using URLs as the primary form of input. An input validation error vulnerability exists in HashiCorp go-getter version 2.0.2 and prior versions, which stems from the inability to...
GHSA-G24C-FX4V-XG9W Mattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service provider
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled...
Mattermost Server allows System Admin to modify LDAP account names and email addresses
An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account...
GHSA-379P-37XC-Q963 Mattermost Server does not check if cookies are used over SSL
An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL...
CVE-2022-26531
Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG...
CVE-2022-29873
A vulnerability has been identified in SICAM T All versions V3.0. Affected devices do not properly validate parameters of certain GET and POST requests. This could allow an unauthenticated attacker to set the device to a denial of service state or to control the program counter and, thus, execute...
DEBIAN-CVE-2021-27548
There is a Null Pointer Dereference vulnerability in the XFAScanner::scanNode function in XFAScanner.cc in xpdf 4.03...
CVE-2022-28617
A remote bypass security restrictions vulnerability was discovered in HPE OneView versions: Prior to 7.0. HPE has provided a software update to resolve this vulnerability in HPE OneView...
GHSA-Q5V2-2V66-6HWM Improper Neutralization of Input During Web Page Generation in Direct Web Remoting
Cross-site scripting XSS vulnerability in Direct Web Remoting DWR through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...