PT-2022-9015 · Unknown +2 · Multimon-Ng +2

Name of the Vulnerable Software and Affected Versions: multimon-ng versions prior to 1.2.0 Description: A critical issue affects the function add ch of the file demod flex.c. The manipulation of the argument ch leads to a format string issue. Recommendations: For versions prior to 1.2.0, upgrade ...

OpenEMR 代码问题漏洞

OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A code issue vulnerability exists in versions prior to OpenEMR 7.0.0.2 that stems...

labstack echo 路径遍历漏洞

labstack echo is the high-performance, minimalist Go Web framework. A security vulnerability exists in the previous version of labstack echo v4.1.18-0.20201215153152-4422e3b66b9f, which stems from incorrect cleanup of user input on Windows, where the static file handler allows for directory...

kernel: tcp: add accessors to read/set tp->snd_cwnd

In the Linux kernel, the following vulnerability has been resolved: tcp: add accessors to read/set tp-sndcwnd We had various bugs over the years with code breaking the assumption that tp-sndcwnd is greater than zero. Lately, syzbot reported the WARNONONCE!tp-priorcwnd added in commit 8b8a321ff72c...

CVE-2022-28764

The Zoom Client for Meetings for Android, iOS, Linux, macOS, and Windows before version 5.12.6 is susceptible to a local information exposure vulnerability. A failure to clear data from a local SQL database after a meeting ends and the usage of an insufficiently secure per-device key encrypting...

CVE-2022-27949

A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed for example when they were depending on past and previous instances of the task failed. This issue affects Apache Airflow prior to 2.3.1...

PYSEC-2022-42981

A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed for example when they were depending on past and previous instances of the task failed. This issue affects Apache Airflow prior to 2.3.1...

Tasmota 缓冲区错误漏洞

Tasmota is a replacement firmware for the ESP8266 with easy configuration using the webUI, OTA updates, automation using timers or rules, scalability, and full local control over MQTT, HTTP, serial or KNX. A security vulnerability exists in previous versions of Tasmota commit number:...

PT-2022-35191 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.1 Description: The issue is related to a potential security vulnerability in the Linux Kernel. It was introduced in version v2.6.21 and fixed in version v6.0.1. The actual impact and attack plausibility hav...

PT-2022-1317 · Intel · Qatzip

Name of the Vulnerable Software and Affected Versions: QATzip software maintained by IntelR versions prior to 1.0.9 Description: The issue is related to improper access control in QATzip software, which may allow an authenticated user to potentially enable escalation of privilege via local access...

.NET 6.0 Update - November 8, 2022 (KB5020743)

None None...

CVE-2022-27912

An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous requests...

PT-2022-18687 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 4.0.0 through 4.2.3 Description: An issue was discovered in Joomla! where sites with publicly enabled debug mode exposed data of previous requests. Recommendations: For Joomla! versions 4.0.0 through 4.2.3, disable the public...

CVE-2022-41844

An issue was discovered in Xpdf 4.04. There is a crash in XRef::fetchint, int, Object, int in xpdf/XRef.cc, a different vulnerability than CVE-2018-16369 and CVE-2019-16088...

Rdiffweb 跨站请求伪造漏洞

Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. It provides quick access to your archives through an efficient web interface. A cross-site request forgery vulnerability exists in Rdiffweb versions prior to 2.4.5. An attacker could exploit this vulnerability t...

CVE-2022-34776

Tabit - giftcard stealth. Several APIs on the web system display, without authorization, sensitive information such as health statements, previous bills in a specific restaurant, alcohol consumption and smoking habits. Each of the described APIs, has in its URL one or more MongoDB ID which is not...

PT-2022-18869 · Nameless · Nameless

Name of the Vulnerable Software and Affected Versions: namelessmc/nameless versions prior to 2.0.2 Description: The issue concerns a session fixation problem. Recommendations: For versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue...

mprweb 信息泄露漏洞

mprweb is a makedeb package repository MPR hosting platform open-sourced by makedeb. An information disclosure vulnerability exists in previous versions of mprweb d13e3f2f5a9c0b0f6782f35d837090732026ad77, which stems from an email address that is not hidden...

CVE-2022-25896

A misleading session regeneration flaw was found in passport. When a user logs in or logs out, the session is regenerated instead of being closed. This flaw allows an attacker to use a previous session in particular environments. Mitigation Mitigation for this issue is either not available or the...

Regular Expression Denial Of Service (ReDoS)

scss-tokenizer is vulnerable to regular expression denial of service. The vulnerability exists in the loadAnnotation function of previous-map.js due to the insecure regex pattern used in the match attribute, allowing an attacker to crash the application by providing malicious input...