Delta Electronics DIAEnergie SQL Injection Vulnerability (CNVD-2022-27555)

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.Delta Electronics...

Delta Electronics DIAEnergie SQL Injection Vulnerability (CNVD-2022-27439)

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.Delta Electronics...

xml-security: XPath Transform abuse allows for information disclosure

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any...

Security Bulletin: IBM Answer Retrieval for Watson Discovery is vulnerable to phishing attacks due to Swagger UI (CVE number(s) 221508)

Summary Swagger UI is used by IBM Answer Retrieval for Watson Discovery. CVE numbers 221508. The fix upgrades to Swagger UI v4.6.2. Vulnerability Details Third Party Entry: 221508 DESCRIPTION: Swagger UI could allow a remote attacker to conduct phishing attacks, caused by an open redirect...

LiquidityFarming.withdraw permanently freezes any unpaidRewards left

Lines of code Vulnerability details Impact Remainder nft.unpaidRewards are lost and cannot be retrieved after LiquidityFarming.withdraw. I.e. it is not possible to extractRewards for unpaidRewards later if withdraw being called when balance wasn't sufficient to fulfil the full withdraw of the...

Aternity SteelCentral AppInternals Directory Traversal Vulnerability (CNVD-2022-22670)

Aternity SteelCentral AppInternals is a monitoring modern automation solution from Aternity, Inc. A directory traversal vulnerability exists in Aternity SteelCentral AppInternals, which stems from the fact that /api/appInternals/1.0/plugin/pmx does not perform any validation of user input that...

CVE-2022-26317

A vulnerability has been identified in Mendix Applications using Mendix 7 All versions V7.23.29. When returning the result of a completed Microflow execution call the affected framework does not correctly verify, if the request was initially made by the user requesting the result. Together with...

CVE-2021-43774

The CVE affects Fujifilm DocuCentre-VI C4471 (1.8) devices. An attacker who gains access to the printer’s administrative web interface (e.g., via default credentials) can download the address book file containing user lists (domain/FTP users, etc.). The passwords are protected by a weak cipher (e...

CVE-2021-43070

Multiple relative path traversal vulnerabilities CWE-23 in FortiWLM management interface 8.6.2 and below, 8.5.2 and below, 8.4.2 and below, 8.3.3 and below, 8.2.2 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests...

Keep Solutions Archeevo 安全漏洞

Keep Solutions Archeevo is a phase of document management software from Keep Solutions, Portugal. Keep archives organizations in all functional areas, covering activities from file description to productivity management. A security vulnerability exists in Keep Solutions Archeevo that could be...

Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2022-1258)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Authentication flaw

A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required...

DEBIAN-CVE-2021-44960

In SVGPP SVG++ library 1.3.0, the XMLDocument::getRoot function in the renderDocument function handled the XMLDocument object improperly, returning a null pointer in advance at the second if, resulting in a null pointer reference behind the renderDocument function...

CVE-2022-25186

CVE-2022-25186 affects the Jenkins HashiCorp Vault Plugin (3.8.0 and earlier). The vulnerability lets an attacker who can control an agent process retrieve vault secrets for an attacker-specified path and key from the agent side. In practical terms, compromised agents can exfiltrate sensitive Vau...

ABB FOX515T Improper Input Validation (CVE-2017-14025)

An Improper Input Validation issue was discovered in ABB FOX515T release 1.0. An improper input validation vulnerability has been identified, allowing a local attacker to provide a malicious parameter to the script that is not validated by the application, This could enable the attacker to retrie...

GitLab Enterprise Edition 访问控制错误漏洞

GitLab Enterprise Edition is a content management system. An Access Control Error vulnerability exists in GitLab Enterprise Edition and Gitlab Community Edition that stems from improperly restricted access. When a remote authenticated attacker is linked to an item in the vulnerability indicator...

CVE-2020-26208

JHEAD is a simple command line tool for displaying and some manipulation of EXIF header data embedded in Jpeg images from digital cameras. In affected versions there is a heap-buffer-overflow on jhead-3.04/jpgfile.c:285 ReadJpegSections. Crafted jpeg images can be provided to the user resulting i...

Use of deprecated Chainlink API

Handle defsec Vulnerability details Impact The contract uses Chainlink’s deprecated API latestAnswer. Such functions might suddenly stop working if Chainlink stopped supporting deprecated APIs. Impact: Deprecated API stops working. Prices cannot be obtained. Protocol stops and contracts have to b...

CVE-2021-41608

CVE-2021-41608 affects ClassApps SelectSurvey.NET (pre-5.052.000) via the UploadedImageDisplay.aspx endpoint. The issue lets a remote, unauthenticated attacker retrieve survey user-submitted data by incrementing the ID parameter from 1 upward, exposing partial confidentiality of data. The vulnera...

CVE-2021-41609

The connected sources confirm a SQL injection vulnerability (CVE-2021-41609) in ClassApps SelectSurvey.NET; the ID parameter of UploadedImageDisplay.aspx allows remote, unauthenticated attackers to retrieve data from the backend DB via boolean-based blind and UNION injections. Affected software: ...