13092 matches found
GHSA-FJ2M-W3WV-X9PR vulnerabilities
Vulnerabilities for packages: trino...
PT-2022-24346 · Cuppacms · Cuppacms
Name of the Vulnerable Software and Affected Versions: Cuppa CMS version 1.0 Description: The issue is related to an arbitrary file upload vulnerability via the File Manager. This allows for potential malicious file uploads. Recommendations: For Cuppa CMS version 1.0, consider disabling the File...
DLA-3103-1 zlib - security update
Bulletin has no description...
DSA-5228-1 gdk-pixbuf - security update
Bulletin has no description...
CVE-2021-40648
In man2html 1.6g, a filename can be created to overwrite the previous size parameter of the next chunk and the fd, bk, fdnextsize, bknextsize of the current chunk. The next chunk is then freed later on, causing a freeing of an arbitrary amount of memory...
CVE-2022-38286
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list...
PT-2022-23326 · Unknown · Culture Object
Name of the Vulnerable Software and Affected Versions: Culture Object plugin versions prior to 4.1 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin or higher privileges can inject malicious scripts into the...
SUSE-SU-2022:3162-1 Security update for libyajl
This update for libyajl fixes the following issues: - CVE-2022-24795: Fixed heap-based buffer overflow when handling large inputs bsc1198405...
PT-2022-18245 · Unknown · Rosariosis Student Information System +1
Name of the Vulnerable Software and Affected Versions: rosariosis versions prior to 10.0 RosarioSIS Student Information System versions prior to 10.1 Description: The issue is related to improper handling of length parameter inconsistency in the GitHub repository francoisjacquet/rosariosis...
Improper Input Validation
Elrond go is the go implementation for the Elrond Network protocol. In versions prior to 1.3.34, anyone who uses elrond-go to process blocks historical or actual could encounter a MultiESDTNFTTransfer transaction like this: MultiESDTNFTTransfer with a missing function name. Basic functionality li...
PYSEC-2022-43069
Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue...
CVE-2022-3008 Command Injection on tinygltf
The tinygltf library uses the C library function wordexp to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using backticks. An attacker could craft an untrusted path input that would result in a path expansion. W...
Prototype Pollution
matrix-js-sdk is vulnerable to Prototype Pollution. The vulnerability exists because the events sent with special strings in key places can temporarily disrupt or impede in the library, which leads to excluding or corrupting runtime data...
CVE-2022-36640
influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint...
SUSE-SU-2022:2985-1 Security update for open-vm-tools
This update for open-vm-tools fixes the following issues: - CVE-2022-31676: Fixed an issue that could allow unprivileged users inside a virtual machine to escalate privileges bsc1202657...
ASB-A-235102694
Bulletin has no description...
ASB-A-235102548
Bulletin has no description...
ASB-A-235102901
Bulletin has no description...