OpenDaylight SQL注入漏洞

OpenDaylight ODL is an open source SDN controller from OpenDaylight Open Source. A security vulnerability exists in versions of OpenDaylight ODL prior to 0.16.5, which originates in its aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/RoleStore.java component in the /auth/ v1/role...

SimpleXMQ 加密问题漏洞

SimpleXMQ is SimpleX Chat open source a reference implementation of the SimpleX messaging protocol . Used for simplex queues on public networks . A security vulnerability exists in SimpleXMQ versions prior to 3.4.0 that stems from its double ratchet protocol's X3DH key exchange process not applyi...

Intel XMM 缓冲区错误漏洞

Intel XMM is a family of 4G LTE, LTE Advanced, LTE Advanced Pro and 5G modems from Intel Corporation USA. A security vulnerability exists in the Intel XMM 7560 Modem software prior to version M27560R01.2146.00, which stems from incorrect buffer restrictions in the modem software and could allow a...

GLPI 跨站脚本漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

WordPress plugin Goolytics 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. cross-site...

Vim 资源管理错误漏洞

Vim is a cross-platform text editor. A resource management error vulnerability exists in versions prior to Vim 9.0.0579 that stems from reuse after release. No details of the vulnerability are provided at this time...

PT-2022-34420 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.256 Description: A potential use after free issue has been identified. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to v4.19.256,...

CVE-2022-40322

SysAid Help Desk before 22.1.65 allows XSS, aka FR 66542 and 65579...

PT-2022-28282 · Unknown · Moment-Timezone

Name of the Vulnerable Software and Affected Versions: moment-timezone versions prior to 0.5.35 Description: The issue arises when using grunt data or grunt release to prepare a custom build of moment-timezone with the latest tzdata from IANA's website. If an attacker intercepts the request to...

PT-2022-12362 · Ampere · Ampere Altra +1

Name of the Vulnerable Software and Affected Versions: Ampere Altra versions before SRP 1.08b Ampere Altra Max versions before SRP 2.05 Description: The issue allows information disclosure of power telemetry via HWmon. Recommendations: For Ampere Altra versions before SRP 1.08b, update to SRP 1.0...

Hewlett Packard Enterprise Integrated Lights-Out 5 安全漏洞

Hewlett Packard Enterprise Integrated Lights-Out 5 iLO 5 is a remote control solution from Hewlett Packard Enterprise. The solution enables remote monitoring and operation of IT assets such as servers. A security vulnerability exists in Hewlett Packard Enterprise Integrated Lights-Out 5 iLO 5...

shoutrrr 安全漏洞

shoutrrr is based on the JavaScript notification library. A security vulnerability exists in shoutrrr prior to version 0.6.0, which stems from a Denial of Service DoS vulnerability in package github.com/containrrr/shoutrrrr/pkg/util prior to version 0.6.0 via the util.PartitionMessage function. T...

CVE-2022-33698

Exposure of Sensitive Information in Telecom application prior to SMR Jul-2022 Release 1 allows local attackers to access ICCID via log...

MAL-2022-5451 Malicious code in prerelease-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9616f1565493e2eca538eb780a3858bba8eba8137467ce81fa87a45eea341072 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-2066

Cross-site Scripting XSS - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06...

GHSA-9QGF-4FPF-CMH2 Improper Neutralization of Input During Web Page Generation in Jenkins

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the reason why a queue items is blcoked in tooltips, resulting in a stored XSS vulnerability exploitable by users able to control parts of the reason a queue item is blocked, such as label expressions not matching any idle executor...

Mattermost Server is vulnerable to webhook and slash command manipulation

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API...

rengine 操作系统命令注入漏洞

rengine is an automated reconnaissance framework for collecting information during penetration testing of web applications. An operating system command injection vulnerability exists in versions of rengine prior to 1.2.0, which can be exploited by an attacker to execute illegal operating system...

apache-httpclient: incorrect handling of malformed authority component in request URIs

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution...

Google Go 安全漏洞

Google Go is a statically strongly typed, compiled, concurrent, and garbage collected programming language from Google Google, U.S.A. A vulnerability exists in versions of Google Go prior to 1.17.9 and prior to 1.18.1, which stems from the generic P-256 feature in crypto/elliptic allowing long...