CVE-2022-21264

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

CVE-2022-21260

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Samples. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Serve...

Authentication flaw

Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, and read sensitive information or upload an arbitrary ZIP archive to the server...

PT-2022-11489

Name of the Vulnerable Software and Affected Versions M-Files Server versions prior to 22.1.11017.1 Description The issue concerns a Server-Side Request Forgery SSRF vulnerability. It is related to a preview function in M-Files Server products that allows making queries from the server with certa...

PT-2022-2015 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.27 and prior Description: The issue is related to a buffer read overflow in the memory of the MySQL Server component, specifically in the Server: DDL subcomponent. This can be exploited by a remote attacker with high...

Nagios XI OS Command Injection

Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server...

Nextcloud: Nextcloud Deck : Possibility for anyone to add a stack with existing tasks on anyone's board

Hi everyone, Hope you are well ! I found an IDOR vulnerability, allowing any user without privilege to add lists with tasks in any user board. This was tested on a Nextcloud Hub II server v23 with the Deck application in version 1.6.0. Steps To Reproduce: Beforehand: - Have an A user with a board...

Remote code execution

Tenable.sc versions 5.14.0 through 5.19.1 were found to contain a remote code execution vulnerability which could allow a remote, unauthenticated attacker to execute code under special circumstances. An attacker would first have to stage a specific file type in the web server root of the Tenable....

Phoronix Test Suite 跨站请求伪造漏洞

Phoronix Test Suite is a Phoronix Test Suite open source, cross-platform automated testing/benchmarking software. Phoronix Test Suite suffers from a cross-site request forgery vulnerability that stems from a WEB application that does not adequately validate that a request is coming from a trusted...

The vulnerability of the SMB protocol implementation within the in-core CIFS/SMB3-server ksmbd server for Linux operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the SMB protocol implementation within the in-core CIFS/SMB3 server ksmbd server for Linux operating systems is related to the transmission of data in an open manner when the SMB2GLOBALCAPENCRYPTION flag is used. Exploiting this vulnerability can allow a remote attacker to ga...

CVE-2021-43053

The Realm Server component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a difficult to exploit vulnerability that allows an unauthenticated attacker with network access to obtain the cluster secret of another...

Microsoft Exchange Server 安全漏洞

Microsoft Exchange Server is the United States Microsoft Microsoft company's set of e-mail service program. It provides email access, storage, forwarding, voice mail, email filtering and screening. A security vulnerability exists in Microsoft Exchange Server. The following products and versions a...

Debian DLA-2864-1 : ruby-haml - LTS security update

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-2864 advisory. - In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like ' must be escaped properly. In this case, the '...

The vulnerability of the Apache HTTP server, related to the manipulation of requests on the server side, allows attackers to perform SSRF attacks.

The vulnerability of the Apache HTTP server is related to the manipulation of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack by sending specially crafted HTTP requests...

CVE-2021-45789

An arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users can read any file on the server via the file download function...

CVE-2021-20876

Path traversal vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows an attacker with an administrative privilege to obtain sensitive information stored in the hierarchy above the directory on...

Projectworlds Hospital Management System SQL Injection Vulnerability

Projectworlds Hospital Management System is a hospital management system from Projectworlds Austria. version 1.0 of Projectworlds Hospital Management System is vulnerable to SQL injection, which can be exploited by attackers to compromise database system and in some cases use this vulnerability t...

The vulnerability of the WISE-4060 Ethernet module’s microprogramming software, related to shortcomings in password change procedures via the web server, allows a hacker to gain full access to the device with administrator privileges.

The vulnerability of the WISE-4060 Ethernet module’s microprogramming software is related to deficiencies in the password change process via the web server. Exploiting this vulnerability could allow an attacker to gain full access to the device with administrator privileges...

Command Execution Vulnerability in Sunflower Lite Edition

Sunflower is a free all-in-one remote control management tool software that integrates remote control of computer and cell phone, remote desktop connection, remote boot, remote management, and intranet penetration support. A command execution vulnerability exists in Sunflower Lite, which can be...

SUSE-SU-2021:14867-1 Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issues: - CVE-2021-4011: The handlers for the RecordCreateContext and RecordRegisterClients requests of the Record extension do not properly validate the request length leading to out of bounds memory write. bsc1190489...