TOTOLINK A7000R 操作系统命令注入漏洞

The TOTOLINK A7000R is a wireless router from China's Gion Electronics TOTOLINK. An operating system command injection vulnerability exists in TOTOLINK A7000R version V9.1.0u.6115B20201022, which stems from a command injection issue with the addEffect parameter in the setting/setTracerouteCfg...

Pimcore 跨站脚本漏洞

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce frameworks and product information management applications. A cross-site scripting vulnerability exists in...

CVE-2022-35655

Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting...

CVE-2022-2375

The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenticated users to update them. Furthermore, due to the lack of escaping in some of them, it could lead to Stored Cross-Site Scripting issues...

CVE-2022-2375

The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenticated users to update them. Furthermore, due to the lack of escaping in some of them, it could lead to Stored Cross-Site Scripting issues...

CVE-2022-2172 LinkWorth Plugin < 3.3.4 - Arbitrary Setting Update via CSRF

The LinkWorth WordPress plugin before 3.3.4 does not implement nonce checks, which could allow attackers to make a logged in admin change settings via a CSRF attack...

CVE-2022-35655: Improper Neutralization of Input During Web Page Generation

Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting...

PT-2022-22941

Name of the Vulnerable Software and Affected Versions Pega Platform versions 7.3 through 8.7.3 Description The issue is related to a misconfiguration of a datapage setting, leading to an XSS problem. Recommendations For versions 7.3 through 8.7.3, update the datapage setting configuration to...

OctoPrint 安全漏洞

OctoPrint is an application. that provides a fast web interface for controlling consumer 3D printers. A security vulnerability exists in versions prior to OctoPrint 1.8.3 that stems from setting a new password for a user when the product does not require knowledge of the original password or the...

CVE-2022-36233

Tenda AC9 V15.03.2.13 is vulnerable to Buffer Overflow via httpd, formfastsettingwifiset. httpd...

CVE-2022-36233

Tenda AC9 V15.03.2.13 is vulnerable to Buffer Overflow via httpd, formfastsettingwifiset. httpd...

Tenda AC9 缓冲区错误漏洞

Tenda AC9 is a wireless router from Tenda, China. Tenda AC9 V15.03.2.13 is vulnerable to a buffer overflow vulnerability caused by a stack buffer overflow in formfastsettingwifiset in the httpd server. An authenticated local attacker can exploit this vulnerability to cause a denial of service...

CVE-2022-35978

Minetest is a free open-source voxel game engine with easy modding and game creation. In single player, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs i...

PT-2022-23076 · Minetest +2 · Minetest +2

Name of the Vulnerable Software and Affected Versions: Minetest versions prior to 5.6.1 Description: The issue concerns a security vulnerability in Minetest, a free open-source voxel game engine, where a mod in single-player mode can set a global setting to control the Lua script loaded for the...

CVE-2022-35942

The CVE-2022-35942 issue affects loopback-connector-postgresql (LoopBack) where improper input validation of the contains filter allows SQL injection when interpreted by the PostgreSQL connector. A patch was released in loopback-connector-postgresql v5.5.1 to fix this. Impacts include cases where...

loopback-connector-postgresql Vulnerable to Improper Sanitization of `contains` Filter

Improper input validation on the contains LoopBack filter may allow for arbitrary SQL injection. Impact When the extended filter property contains is permitted to be interpreted by the Postgres connector, it is possible to inject arbitrary SQL which may affect the confidentiality and integrity of...

PT-2025-26158

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved. The issue occurs on systems that implement FEAT EPAN, where read/write access to the idmap is denied because UXN is not set on the...

CVE-2022-33714

Improper access control vulnerability in SemWifiApBroadcastReceiver prior to SMR Aug-2022 Release 1 allows attacker to reset a setting value related to mobile hotspot...

CVE-2022-33714

Improper access control vulnerability in SemWifiApBroadcastReceiver prior to SMR Aug-2022 Release 1 allows attacker to reset a setting value related to mobile hotspot...

CVE-2022-2459

GitLab Enterprise Edition (GitLab EE) is affected by CVE-2022-2459 in affected versions prior to 15.0.5, versions 15.1 before 15.1.4, and versions 15.2 before 15.2.1. Description: an issue could allow email-invited members to join a project even after the group-owner setting to prevent adding mem...