2869 matches found
CVE-2022-25161
CVE-2022-25161 is an Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F Series controllers (FX5U FX5UCFX5S FX5UJ CPU modules, etc.). A remote, unauthenticated attacker can trigger a denial-of-service by sending specially crafted packets to affected Ethernet communications,...
Incorrect Authorization in publify
Improper Access Control in GitHub repository publify/publify prior to 9.2.8. Anonymous users can't view but can leave comments on an article in draft mode...
GHSA-W2XF-4GG9-87WR Centreon allows SNMP trap SQL Injection
Centreon 3.4.x fixed in Centreon 18.10.0 and Centreon web 2.8.27 allows SNMP trap SQL Injection...
GHSA-7R36-JF3C-JHP4 Duplicate Advisory: tgstation-server vulnerable to cached user logins in legacy server
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-42r6-p4px-qvv6. This link is maintained to preserve external references. Original Description In Tgstation tgstation-server 3.2.4.0 through 3.2.1.0 fixed in 3.2.5.0, active logins would be cached, allowing...
GHSA-8Q8V-28RM-QW4W Borg Improper Access Control vulnerability
Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers 1.1.x before 1.1.3...
Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack
Cross-site request forgery CSRF vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method...
Code injection
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, an authenticated attacker can modify or delete Dashboards created by other BIG-IP users in the Traffic Management User Interface TMUI. Note: Software versions which have reach...
Code injection
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when a Real Time Streaming Protocol RTSP profile is configured on a virtual server, undisclosed traffic can cause an increase in Traffic...
Code injection
On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, the BIG-IP Edge Client Component...
CVE-2022-1388
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End o...
Jenkins Vulnerable to Denial of Service (DoS) via Crafted Payload
Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload...
Tenda HG6 3.3.0 Remote Command Injection
Tenda HG6 v3.3.0 Remote Command Injection Vulnerability Vendor: Tenda Technology Co.,Ltd. Product web page: https://www.tendacn.com https://www.tendacn.com/product/HG6.html Affected version: Firmware version: 3.3.0-210926 Software version: v1.1.0 Hardware Version: v1.0 Check Version:...
GHSA-2C7W-V459-CWGF MotionEye allows attackers to access sensitive information
MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured...
Online Sports Complex Booking System 1.0 Account Takeover Vulnerability
Exploit Title: Online Sports Complex Booking System - Account Takeover Unauthenticated Exploit Author: Saud Alenazi Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html Version:...
OPENSUSE-SU-2022:0940-1 Security update for xen
This update for xen fixes the following issues: Update Xen to version 4.14.4 bsc1027519 Transient execution side-channel attacks attacking the Branch History Buffer BHB, named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated. Security issues fixed: -...
CVE-2022-22394
The IBM Spectrum Protect 8.1.14.000 server could allow a remote attacker to bypass security restrictions, caused by improper enforcement of access controls. By signing in, an attacker could exploit this vulnerability to bypass security and gain unauthorized administrator or node access to the...
OPENSUSE-SU-2022:0886-1 Security update for libreoffice
This update for libreoffice fixes the following issues: Update to version 7.2.5.1 jscSLE-18214: - CVE-2021-25636: Fixed an incorrect vadidation of digitally signed documents bsc1196456...
Microweber Information Disclosure Vulnerability (CNVD-2022-71439)
Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. An information disclosure vulnerability exists in versions of Microweber prior to 1.3, which stems from the fact that when...
Northstar Club Management Operating System Command Injection Vulnerability
Northstar Club Management is a web-based solution from Northstar, Inc. that allows organizations to manage all elements of a club, such as memberships, guests, events, and more. An operating system command injection vulnerability exists in Northstar Club Management version 6.3, which stems from a...