CVE-2022-3340 Trellix IPS Manager vulnerable to XXE

XML External Entity XXE vulnerability in Trellix IPS Manager prior to 10.1 M8 allows a remote authenticated administrator to perform XXE attack in the administrator interface part of the interface, which allows a saved XML configuration file to be imported...

Trellix IPS Manager 代码问题漏洞

Trellix IPS Manager is a next-generation IPS for local and virtual networks from American FireEye Trellix. A security vulnerability exists in Trellix IPS Manager versions prior to 10.1 M8, which stems from the ability to import a saved XML configuration file through an external entity attack by a...

Improper access control

An improper access control CWE-284 vulnerability in FortiOS version 7.2.0 and versions 7.0.0 through 7.0.7 may allow a remote authenticated read-only user to modify the interface settings via the API...

CVE-2022-38380

An improper access control CWE-284 vulnerability in FortiOS version 7.2.0 and versions 7.0.0 through 7.0.7 may allow a remote authenticated read-only user to modify the interface settings via the API...

CVE-2022-43749

Improper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-1601 allows remote authenticated users to bypass security constraint via unspecified vectors...

Privilege escalation

Improper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-1601 allows remote authenticated users to bypass security constraint via unspecified vectors...

CVE-2022-43749

CVE-2022-43749 is an improper privilege management vulnerability in Synology Presto File Server’s summary report management, affecting versions prior to 2.1.2-1601. It allows remote authenticated users to bypass security constraints via unspecified vectors. Public sources in the connected documen...

CVE-2022-43749

Improper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-1601 allows remote authenticated users to bypass security constraint via unspecified vectors...

CVE-2022-43749

Improper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-1601 allows remote authenticated users to bypass security constraint via unspecified vectors...

Synology Presto File Server 安全漏洞

Synology Presto File Server is a high-speed file transfer suite from China-based Synology Inc. A security vulnerability exists in Synology Presto File Server versions prior to 2.1.2-1601, which stems from improper privilege management in Summary Report Management and allows remote authenticated...

CVE-2022-35132

Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module...

Server side request forgery (ssrf)

Server-Side Request Forgery SSRF vulnerability in Package Center functionality in Synology DiskStation Manager DSM before 7.1-42661 allows remote authenticated users to access intranet resources via unspecified vectors...

Command injection

Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module...

CVE-2022-27622

Server-Side Request Forgery SSRF vulnerability in Package Center functionality in Synology DiskStation Manager DSM before 7.1-42661 allows remote authenticated users to access intranet resources via unspecified vectors...

CVE-2022-33183

A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, 7.4.2.j could allow a remote authenticated attacker to perform stack buffer overflow using in “firmwaredownload” and “diagshow” commands...

CVE-2022-35132

Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module...

CVE-2022-36368

Multiple stored cross-site scripting vulnerabilities in the web user interface of IPFire versions prior to 2.27 allows a remote authenticated attacker with administrative privilege to inject an arbitrary script...

PT-2022-25476 · Bookstack · Bookstack

Name of the Vulnerable Software and Affected Versions: BookStack versions prior to v22.09 Description: A cross-site scripting issue allows a remote authenticated attacker to inject an arbitrary script. Recommendations: For versions prior to v22.09, update to version v22.09 or later to resolve the...

CVE-2022-41799

Improper access control vulnerability in GROWI prior to v5.1.4 v5 series and versions prior to v4.5.25 v4 series allows a remote authenticated attacker to bypass access restriction and download the markdown data from the pages set to private by the other users...

CVE-2022-2637

Incorrect Privilege Assignment vulnerability in Hitachi Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation.This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.8.0 before 04.9.0...