13092 matches found
CVE-2022-3293
Email addresses were leaked in WebHook logs in GitLab EE affecting all versions from 9.3 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1...
GHSA-4VJ2-426R-JM3G Magento Open Source allows Stored Cross-Site Scripting (Stored XSS)
Adobe Commerce versions 2.4.3-p3 and earlier, 2.4.4-p1 and earlier and 2.4.5 and earlier are affected by a Stored Cross-site Scripting vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution...
SUSE-SU-2022:3590-1 Security update for python-Babel
This update for python-Babel fixes the following issues: - CVE-2021-42771: Fixed relative path traversal bsc1185768...
CVE-2022-24697 Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters
Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the comma...
SQL Injection
CodeIgniter is vulnerable to sql injection. The vulnerability exists due to improper implementation of having function of DBquerybuilder.php which allows an attacker to inject and execute malicious sql queries in the system...
CVE-2022-40047
Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting XSS vulnerability via the page parameter at /flatpress/admin.php...
CVE-2022-40494
NPS before v0.26.10 was discovered to contain an authentication bypass vulnerability via constantly generating and sending the Auth key and Timestamp parameters...
Want More Secure Software? Start Recognizing Security-Skilled Developers
Professional developers want to do the right thing, but in terms of security, they are rarely set up for success. Organizations must support their upskilling with precision training and incentives if they want secure software from the ground up. The cyber threat landscape grows more complex by th...
ASB-A-238103939
Bulletin has no description...
ASB-A-205570663
In avrcctrlparsvendorrsp of avrcparsct.cc, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
ASB-A-234037216
In ims, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
DLA-3130-1 tinyxml - security update
Bulletin has no description...
ASB-A-238108282
Bulletin has no description...
CVE-2022-40315
A limited SQL injection risk was identified in the "browse list of users" site administration page...
Remote Code Execution (RCE)
redshift-jdbc42 is vulnerable to remote code execution. The vulnerability exists because the verifyPeerName function of MakeSSL.java does not properly check the class type when instantiating an object from a class name, allowing an attacker to inject and execute malicious code through the object...
PT-2022-8272 · Undefined · Undefined
Name of the Vulnerable Software and Affected Versions: No vulnerable software or affected versions specified. Description: The provided information does not contain details about a specific vulnerability. It appears to be a notification about a rejected CVE candidate number, CVE-2019-20318, with ...
GHSA-WJPV-FRF2-3R58 EC-CUBE Directory traversal vulnerability
Directory traversal vulnerability in EC-CUBE 3 series EC-CUBE 3.0.0 to 3.0.18-p4 and EC-CUBE 4 series EC-CUBE 4.0.0 to 4.1.2 allows a remote authenticated attacker with an administrative privilege to obtain the product's directory structure information...
DSA-5244-1 chromium - security update
Bulletin has no description...