GHSA-QH36-44JV-C8XJ Potential proxy IP restriction bypass in Kubernetes

As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a...

Time-of-check Time-of-use (TOCTOU) Race Condition

As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a...

PT-2022-12353 · Sourcecodester · Simple Cold Storage Management System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Simple Cold Storage Management System version 1.0 Description: An SQL Injection issue exists in the login functionality, specifically through the username field in the login.php file. This allows for potential unauthorized acce...

Type confusion

The checkprivacysettings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web...

CVE-2021-24814 WordPress GDPR & CCPA < 1.9.26 - Authenticated Reflected Cross-Site Scripting

The checkprivacysettings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web...

CVE-2020-8562

As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a...

PT-2022-16118 · Unknown · Itunesrpc-Remastered

Name of the Vulnerable Software and Affected Versions: iTunesRPC-Remastered versions prior to commit 24f43aa Description: The issue concerns a discord rich presence application for use with iTunes & Apple Music, where user input is not properly sanitized, allowing code injection. Users are advise...

PT-2022-16426 · Adenza · Adenza Axiomsl Controllerview

Name of the Vulnerable Software and Affected Versions: Adenza AxiomSL ControllerView versions through 10.8.1 Description: The issue allows an attacker to identify valid usernames on the platform due to a difference in error messages produced by failed login attempts when the username is valid...

admin is not set in any function

Handle rfa Vulnerability details Impact all function that need to validate msg.sender == admin cannot be run. BscDexAggregator.sol Proof of Concept BscDexAggregator.sol is the child contract of Adminable.sol. some function in it need to validate that msg.sender is admin. There is no function that...

CVE-2021-22818

The vulnerability CVE-2021-22818 affects Schneider Electric EVlink charging solutions: EVlink City EVC1S22P4/EVC1S7P4, EVlink Parking EVW2/EVF2/EVP2PE, and EVlink Smart Wallbox EVB1A, all versions prior to R8 V3.4.0.2. Root cause: CWE-307 Improper Restriction of Excessive Authentication Attempts,...

CVE-2021-22819

The CVE-2021-22819 entry describes a CWE-1021 vulnerability in Schneider Electric EVlink products where UI rendered in iframes can lead to unintended modification of product settings or user accounts when a user is deceived into interacting with the embedded interface. Affected are EVlink City (E...

CVE-2021-22819

A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the product settings or user accounts when deceiving the user to use the web interface rendered within iframes. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 All...

PT-2022-12116 · Reolink · Reolink Rlc-410W

Name of the Vulnerable Software and Affected Versions: reolink RLC-410W version 3.0.0.136 20121102 Description: A denial of service issue exists in the cgiserver.cgi JSON command parser functionality. This can be triggered by a specially-crafted HTTP request, leading to a reboot. The GetMdAlarm...

Mageia: Security Advisory (MGASA-2019-0241)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2020-0050)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2019-0067)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2022-12056 · Reolink · Reolink Rlc-410W

Name of the Vulnerable Software and Affected Versions: reolink RLC-410W version 3.0.0.136 20121102 Description: A denial of service issue exists in the cgiserver.cgi JSON command parser functionality. This can be triggered by a specially-crafted HTTP request, leading to a reboot. The SetCrop para...

PT-2022-12108 · Reolink · Reolink Rlc-410W

Name of the Vulnerable Software and Affected Versions: reolink RLC-410W version 3.0.0.136 20121102 Description: A denial of service issue exists in the cgiserver.cgi JSON command parser functionality. This can be triggered by a specially-crafted HTTP request, leading to a reboot. The search param...

Mageia: Security Advisory (MGASA-2015-0109)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2022-11232 · Reolink · Reolink Rlc-410W

Name of the Vulnerable Software and Affected Versions: reolink RLC-410W version 3.0.0.136 20121102 Description: An authentication bypass issue exists in the cgiserver.cgi Login functionality. A specially-crafted HTTP request can lead to authentication bypass, allowing an attacker to send an HTTP...