14743 matches found
PT-2022-18716 · Tesla · Tesla Vehicles
Name of the Vulnerable Software and Affected Versions: Tesla vehicles through 2022-03-26 Description: The issue allows attackers to open the charging port of certain Tesla vehicles via a 315 MHz RF signal containing a fixed sequence of approximately one hundred symbols. It is noted that the...
Sql injection
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default...
PT-2022-11774 · Unknown · Dreamer Cms
Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.0.0 Description: An SQL Injection issue exists via the tableName parameter. Recommendations: For Dreamer CMS version 4.0.0, avoid using the tableName parameter until a fix is available. Consider restricting access to the...
PT-2022-17375 · Bluedon Information Security Technologies Co. · Internet Access Detector
Name of the Vulnerable Software and Affected Versions: Bluedon Information Security Technologies Co.,Ltd Internet Access Detector version 1.0 Description: The issue allows attackers to access the contents of the password file via unspecified vectors, resulting in an information leak...
PT-2022-4185 · Unknown +1 · Passwork On-Premise Edition +1
Name of the Vulnerable Software and Affected Versions: Passwork On-Premise Edition versions prior to 4.6.13 Description: The issue is related to incorrect restriction of the path name to a directory with limited access. This allows a remote attacker to upload arbitrary files to the system. The...
PT-2022-4186 · Passwork · Passwork On-Premise Edition +1
Name of the Vulnerable Software and Affected Versions: Passwork On-Premise Edition versions prior to 4.6.13 Description: The issue is related to a CSRF vulnerability in the password manager Passwork. This vulnerability can be exploited by a remote attacker to perform a CSRF attack via the groups,...
PT-2022-12418 · Unknown · Globalprotect-Openconnect
Name of the Vulnerable Software and Affected Versions: GlobalProtect-openconnect versions prior to 2.0.0 Description: The issue is related to incorrect access control in GPService through DBUS and GUI. This allows arbitrary users to start a VPN connection to arbitrary servers. An attacker can hos...
PT-2022-17900 · Primekey · Primekey Signserver
Name of the Vulnerable Software and Affected Versions: PrimeKey SignServer versions prior to 5.8.1 Description: A cross-site scripting XSS issue was identified in the Admin Web interface. This issue can be exploited by using JavaScript code in a worker name before a Generate CSR request. It is...
Wordpress iQ Block Country 1.2.13 Plugin - Arbitrary File Deletion via Zip Slip Vulnerability
Exploit Title: Wordpress Plugin iQ Block Country 1.2.13 - Arbitrary File Deletion via Zip Slip Authenticated Exploit Author: Ceylan Bozoğullarından Blog Post: https://bozogullarindan.com/en/2022/01/wordpress-iq-block-country-1.2.13-admin-arbitray-file-deletion-via-zip-slip/ Software Link:...
CVE-2022-24125
The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send arbitrary push requests to clients via a RequestSendMessageToPlayers request. For example, ability to send a push message to hundreds of thousands of machines is only restricted o...
CVE-2022-27245
An issue was discovered in MISP before 2.4.156. app/Model/Server.php does not restrict generateServerSettings to the CLI. This could lead to SSRF...
Design/Logic Flaw
A permissions issue was addressed with improved validation. This issue is fixed in Security Update 2022-001 Catalina, macOS Monterey 12.2, macOS Big Sur 11.6.3. An application may be able to access restricted files...
CVE-2022-22653
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.4 and iPadOS 15.4. A malicious website may be able to access information about the user and their devices...
MISP 代码问题漏洞
MISP is an open source software solution. The product is used to collect, store, distribute, and share cybersecurity metrics with features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP versions prior to 2.4.156, which stems from...
Exploit for Authentication Bypass by Spoofing in Apache Apisix
CVE-2022-24112-POC Apache APISIX 2.12.1 Rem...
PT-2022-2075
Name of the Vulnerable Software and Affected Versions Paramiko versions prior to 2.10.1 Description The issue is related to a race condition in the write private key file function, which could allow unauthorized information disclosure due to synchronization errors when using a shared resource. Th...
SolarWinds Orion Platform 2020.2.0 < 2020.2.4
The version of SolarWinds Orion Platform installed on the remote host is prior to 2020.2.4. It is, therefore, affected by a vulnerability as referenced in the orionplatform202024 advisory. - This vulnerability allows remote attackers to execute escalate privileges on affected installations of...
PT-2022-17344 · Unknown · Stb Truetype.H
Name of the Vulnerable Software and Affected Versions: stb truetype.h version 1.26 Description: A heap-buffer-overflow issue was discovered in stb truetype.h via the function ttULONG. It is noted that the source code includes a disclaimer stating it should only be used with trusted input. A third...
USN-5326-1 fuse vulnerability
It was discovered that FUSE is susceptible to a restriction bypass flaw on a system that has SELinux active. A local attacker with non-root privileges could mount a FUSE file system that is accessible to other users and trick them into accessing files on that file system, which could result in a...