lighttpd 代码问题漏洞

lighttpd is an open source web server from Jan Kneschke, a German individual developer. A security vulnerability exists in lighttpd 1.4.65, which stems from the fact that modwstunnel does not initialize handler function pointers and can be exploited by an attacker to cause a denial of service...

CVE-2022-1368 Cognex 3D-A1000 Dimensioning System Missing Authentication for Critical Function

The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 3354 and prior is vulnerable to CWE-306: Missing Authentication for Critical Function, which allows unauthorized users to change the operator account password via webserver commands by monitoring web socket communications from an...

CVE-2021-43565

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server...

The vulnerability of the ActiveX control on the SCADA server of Measuresoft ScadaPro Server allows a intruder to execute arbitrary code.

The vulnerability of the ActiveX control in the SCADA server of Measuresoft ScadaPro Server relates to reading data outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

mysql: C API unspecified vulnerability (CPU Oct 2022)

Vulnerability in the MySQL Server product of Oracle MySQL component: C API. Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.2)

The version of AOS installed on the remote host is prior to 5.19.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.19.2 advisory. - Perl before 5.30.3 has an integer overflow related to mishandling of a PLregkindOPn == NOTHING situation. A crafted regular...

CVE-2022-2892 Measuresoft ScadaPro Server Out-of-bounds Write

Measuresoft ScadaPro Server Versions prior to 6.8.0.1 uses an unmaintained ActiveX control, which may allow an out-of-bounds write condition while processing a specific project file...

CVE-2022-36048 IP address leak via image proxy bypass in Zulip Server

Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. When displaying messages with embedded remote images, Zulip normally loads the image preview via a go-camo proxy server. However, an attacker who can send messages could include a crafted URL...

PT-2022-23141 · Unknown · Zulip Server

Name of the Vulnerable Software and Affected Versions: Zulip Server versions prior to 5.6 Description: The issue arises when displaying messages with embedded remote images. Normally, Zulip loads the image preview via a go-camo proxy server. However, an attacker who can send messages could includ...

The vulnerability of the DNS-server BIND daemon, which allows a hacker to cause a service failure.

The vulnerability of the DNS-server BIND daemon is related to the use of the assert function or similar operators. Exploiting this vulnerability allows a remote attacker to cause a service failure...

@abramltd/jwt-oauth2-middleware (=0.1.0), @aerocorp/cli (=7.0.5) +168 more potentially affected by CVE-2020-26938 via oauth2-server (>=2.2.2 <=3.1.1)

oauth2-server NPM version =2.2.2, =1.0.0, =0.0.1, =2.1.0, =3.0.0, =0.4.1, =0.1.0, =3.0.0, =8.9.7 - @intlayer/chokidar =3.5.8 and more Source cves: CVE-2020-26938 Source advisory: OSV:GHSA-4RG6-FM25-GC34...

PT-2022-8851 · Unknown · Oauth2-Server

Name of the Vulnerable Software and Affected Versions: oauth2-server aka node-oauth2-server versions 3.1.1 and earlier Description: The issue arises from an incorrect URI pattern a-zA-Za-zA-Z0-9+.-+: used to check the redirect uri parameter during authorization and token requests. This flaw allow...

Design/Logic Flaw

A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related performance concerns or an unwanted disk...

CVE-2022-0084

A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related performance concerns or an unwanted disk...

PT-2022-23888 · Mdaemon Technologies · Mdaemon Securitygateway For Email Servers

Name of the Vulnerable Software and Affected Versions: MDaemon Technologies SecurityGateway for Email Servers version 8.5.2 Description: The issue allows for IFRAME Injection via the currentRequest parameter after login, which can lead to the injection of malicious tags, resulting in IFRAME...

CVE-2022-36261

An arbitrary file deletion vulnerability was discovered in taocms 3.0.2, that allows attacker to delete file in server when request url admin.php?action=file&ctrl=del&path=/../../../test.txt...

CVE-2022-36261

An arbitrary file deletion vulnerability was discovered in taocms 3.0.2, that allows attacker to delete file in server when request url admin.php?action=file&ctrl=del&path=/../../../test.txt...

CVE-2022-36261

CVE-2022-36261 affects taocms 3.0.2. The connected sources describe an arbitrary file deletion flaw exploitable via a crafted request to admin.php?action=file&ctrl=del&path=/../../../test.txt, indicating a path traversal issue that can delete server files. The NVD notes a CVSS v3.1 base score of ...

CVE-2022-33916

OPC UA .NET Standard Reference Server 1.04.368 allows a remote attacker to cause the application to access sensitive information...

Fishbowl Inventory 代码问题漏洞

Fishbowl Inventory is an inventory optimization business solution integration from Fishbowl USA, Inc. for automating critical business processes and improving efficiency. A security vulnerability exists in Fishbowl Inventory versions prior to 2022.4.1, which stems from a Java deserialization...