Server memory information leak via SMB1.

Description Please note that only versions of Samba prior to 4.11.0 are vulnerable to this bug by default. Samba versions 4.11.0 and above disable SMB1 by default, and will only be vulnerable if the administrator has deliberately enabled SMB1 in the smb.conf file. All versions of Samba with SMB1...

MOXA NPort 5110 缓冲区错误漏洞

The Moxa NPort 5110 is a general purpose device server from MOXA. The Moxa NPort 5110 suffers from an out-of-bounds write vulnerability that can be exploited by an attacker to cause the device to be unresponsive...

The vulnerability of the Microsoft Internet Information Services (IIS) Server network services on the Windows operating system allows a perpetrator to cause a service failure.

The vulnerability of the Microsoft Internet Information Services IIS Server network services on the Windows operating system is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

Command injection

The server in Citilog 8.0 allows an attacker in a man in the middle position between the server and its smart camera Axis M1125 to see FTP credentials in a cleartext HTTP traffic. These can be used for FTP access to the server...

RUSTSEC-2022-0037 Denial of service on deeply nested fragment requests

Deeply nested fragments in a GraphQL request may cause a stack overflow in the server...

Couchbase Server 日志信息泄露漏洞

Couchbase Server is a distributed, open source NoSQL non-relational database from Couchbase, Inc. that supports data querying, full-text searching, and active global replication. A security vulnerability exists in Couchbase Server versions prior to 7.0.4, which stems from a private key that can b...

Vulnerability of the Server component: The Optimizer component of the MySQL Server database management system, which allows attackers to modify, add, or delete data, or to cause service interruptions.

The vulnerability of the MySQL Server component of the database management system involves insufficient validation of input data. Exploiting this vulnerability allows an attacker, operating remotely, to modify, add, or delete data, or cause service interruptions...

389-ds-base: expired password was still allowed to access the database

A vulnerability was found in the 389 Directory Server. This issue allows expired passwords to access the database, causing improper authentication...

CVE-2022-21530

CVE-2022-21530 affects Oracle MySQL Server (Server: Optimizer) and is applicable to MySQL 8.0.29 and prior. The description states that a high-privilege attacker with network access via multiple protocols can cause the MySQL Server to hang or crash (complete DOS). The CVSS 3.1 base score is 4.9 (...

CVE-2022-21530

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

CVE-2022-21525

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

Oracle MySQL 输入验证错误漏洞

Oracle MySQL is an open source relational database management system from Oracle Corporation.MySQL Server is one of the database server components. An input validation error vulnerability exists in Oracle MySQL Server 8.0.29 and prior versions, which originated when an attacker with elevated...

MiCODUS MV720 GPS 跨站脚本漏洞

The MiCODUS MV720 GPS is a GPS tracker from MiCODUS USA. The MiCODUS MV720 GPS suffers from a cross-site scripting vulnerability that stems from a reflected cross-site scripting vulnerability in the main web server, which could allow an attacker to gain control by tricking a user into making a...

PT-2022-3738 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.29 and prior Description: A vulnerability in the MySQL Server product allows a highly privileged attacker with network access via multiple protocols to compromise the server. The vulnerability is difficult to exploit...

CVE-2022-35404

ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine...

LY Corporation: Stored XSS Via Filename On https://partners.line.me/

An XSS vulnerability was found on the file upload feature of "partners.line.me". Attackers could upload a file with an XSS payload in the filename, which was not properly escaped by the server. This allowed for DOM-based XSS to be embedded in HTML. The uploaded files were stored for a limited tim...

CVE-2022-31208

An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The webserver contains an endpoint that can execute arbitrary commands by manipulating the cmdstring URL parameter...

Insecure redirect when submit invalid form

Description When submit invalid form, the server will redirect to url which obtain via Referrer header. Proof of Concept POST /create-shelf HTTP/2 Host: book.dansmonorage.blue Cookie: csrftoken=ZpIuGbCcxOyhta5bki4N46N7vknEAcpaG3881kcMAfWKBEYKEiLEeSc3Sr4lUTVa; djangolanguage=en-us;...

Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability

...

Microsoft Windows Internet Information Services 权限许可和访问控制问题漏洞

Microsoft Windows Internet Information Services IIS is a Web server from Microsoft Corporation for the Windows Server platform. A vulnerability exists in Microsoft Windows Internet Information Services with privilege permission and access control issues. The following products and editions are...