Alist 代码问题漏洞

Alist is a file listing program with multi-storage support by a Chinese Xhofe individual developer. A security vulnerability exists in Alist version v3.4.0, which stems from the existence of a file upload vulnerability that allows a user with only file upload privileges to upload any file to any...

Amazon Linux AMI : curl (ALAS-2022-1646)

The version of curl installed on the remote host is prior to 7.61.1-12.101. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1646 advisory. A vulnerability was found in curl. This security flaw allows reusing OAUTH2-authenticated connections without properly...

CVE-2022-29839

Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices that could allow an attacker who has gained access to a relevant endpoint to use that information to access protected data. This issue affects: Western Digital My Cloud My Clou...

Design/Logic Flaw

Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices that could allow an attacker who has gained access to a relevant endpoint to use that information to access protected data. This issue affects: Western Digital My Cloud My Clou...

CVE-2022-29839

CVE-2022-29839 concerns Western Digital My Cloud devices with Linux, prior to version 5.25.124. The issue is an Insufficiently Protected Credentials vulnerability in the remote backups application; if an attacker gains access to a relevant endpoint, they may use exposed credentials to access prot...

CVE-2022-29839 Remote Backups Application Discloses Stored Credentials

Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices that could allow an attacker who has gained access to a relevant endpoint to use that information to access protected data. This issue affects: Western Digital My Cloud My Clou...

PT-2022-19869 · Western Digital · Western Digital My Cloud

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud versions prior to 5.25.124 on Linux. Description: The issue is related to an Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices. This could allow a...

The vulnerability of the rsync platform used in OpenStack platforms for cloud computing solutions allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the rsync platform used in OpenStack platforms for cloud computing solutions is related to security configuration errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

PT-2022-6689 · Vmware · Vmware Esxi

Name of the Vulnerable Software and Affected Versions: VMware ESXi affected versions not specified Description: The issue is related to a heap-overflow vulnerability in VMware ESXi. A malicious local actor with restricted privileges within a sandbox process may exploit this issue to achieve a...

Mitsubishi Electric FA Engineering Software (Update C)

1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Mitsubishi Electric Equipment: GX Works3, MX OPC UA Module Configurator-R Vulnerabilities: Cleartext Storage of Sensitive Information, Use of Hard-coded Password, Insufficiently Protected Credentials,...

PT-2022-6244 · Ami · Ami Megarac

Name of the Vulnerable Software and Affected Versions: AMI MegaRAC affected versions not specified Description: The issue is related to insufficient protection of service data in the implementation of the application programming interface of the AMI MegaRAC firmware controllers for remote...

CISA Warns of Multiple Critical Vulnerabilities Affecting Mitsubishi Electric PLCs

The U.S. Cybersecurity and Infrastructure Security Agency CISA this week released an Industrial Control Systems ICS advisory warning of multiple vulnerabilities in Mitsubishi Electric GX Works3 engineering software. "Successful exploitation of these vulnerabilities could allow unauthorized users ...

PT-2022-26342 · Nvidia +1 · Nvidia Gpu Display Driver +1

Name of the Vulnerable Software and Affected Versions: NVIDIA vGPU Display Driver for Linux guest affected versions not specified Description: The issue is related to a vulnerability in a D-Bus configuration file. An unauthorized user in the guest VM can impact protected D-Bus endpoints,...

The vulnerability of the Form Manager component in the Firefox browser allows a hacker to disclose protected information.

The vulnerability of the Form Manager component in the Firefox browser is related to the unencrypted storage of user credentials. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

The vulnerability of the Windows Graphics component of the Windows operating system allows attackers to disclose protected information.

The vulnerability of the Windows Graphics component of the Windows operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information...

The vulnerability of the Mixed Reality Developer Tools component for Windows operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Mixed Reality Developer Tools component for Windows operating systems is related to deficiencies in the system’s controlled area segmentation. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

The vulnerability of the Special:UserRights component of the MediaWiki software, which enables the implementation of a hypertext environment, allows a perpetrator to disclose protected information.

The vulnerability of the Special:UserRights component of the MediaWiki software, which is used to implement the hypertext environment, is related to errors in permission handling. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

CVE-2022-42445 HCL Launch is vulnerable to Insufficiently Protected LDAP Search Credentials (CVE-2022-42445)

HCL Launch could allow a user with administrative privileges, including "Manage Security" permissions, the ability to recover a credential previously saved for performing authenticated LDAP searches...

The vulnerability of the Microsoft.NET Framework, related to the disclosure of information, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Microsoft.NET Framework is related to the exposure of information. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the ImageConversion.api file in programs for viewing and editing PDF files in Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, and Adobe Acrobat Reader Document Cloud 2017 arises from reading data beyond the buffer in memory. This allows attackers to disclose protected information.

The vulnerability of the ImageConversion.api file in programs for viewing and editing PDF files in Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, and Adobe Acrobat Reader Document Cloud 2017 is related to reading data outside of the buffer in memory...