OESA-2022-1750 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: Incomplete cleanup of multi-core shared buffers for some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access.CVE-2022-21123 Incomplete cleanup of microarchitectural fill...

The vulnerability of the outputFunctionName function in the Node.js web application framework allows a attacker to execute arbitrary commands.

The vulnerability of the outputFunctionName function in the Node.js web application framework is related to incorrect elimination of special elements in the output data used by the incoming component. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely...

The vulnerability of the Standard Operation and Monitoring function in distributed control systems such as CENTUM VP and CENTUM VP Entry Class allows attackers to execute arbitrary commands.

The vulnerability of the Standard Operation and Monitoring function in distributed control systems such as CENTUM VP and CENTUM VP Entry Class exists due to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability can allow...

CVE-2022-32249

Under special integration scenario of SAP Business one and SAP HANA - version 10.0, an attacker can exploit HANA cockpit�s data volume to gain access to highly sensitive information e.g., high privileged account credentials...

SAP Business One client 注入漏洞

SAP Business One is the German SAP SAP company's set of financial management, operations management and human resources management and other functions of enterprise management software. A code injection vulnerability exists in SAP Business One, which can be exploited by a remote attacker to submi...

php: Special character breaks path in xml parsing

A flaw was found in php. The main cause of this vulnerability is improper input validation while parsing an Extensible Markup LanguageXML entity. A special character could allow an attacker to traverse directories. The highest threat from this vulnerability is confidentiality...

RHEL 7 : rh-php73-php (RHSA-2022:5491)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5491 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: password of excessive length...

Hardcoded credentials

An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions-title, used on Special:Contributions, is used as page title without escaping. Hence, in a non-default configuration where a username contains HTML entities, it won't be escaped...

MediaWiki 跨站脚本漏洞

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. A security vulnerability exists in MediaWiki versions prior to 1.35.7, which stems from the fact...

CVE-2022-34912

An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions-title, used on Special:Contributions, is used as page title without escaping. Hence, in a non-default configuration where a username contains HTML entities, it won't be escaped...

jsrsasign 数据伪造问题漏洞

The jsrsasign package is an open source cryptographic library from the individual developer Kenji Urashima in Japan. A security vulnerability exists in jsrsasign versions prior to 10.5.25, which stems from a vulnerability to incorrect validation of cryptographic signatures when JWS or JWT...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A security vulnerability exists in GitLab CE/EE versions 1.0.2 through 14.10.5...

The vulnerability in the LDAP Account Manager web application exists due to the lack of measures taken to neutralize special elements, allowing attackers to use the user’s username field to manipulate LDAP data.

The vulnerability in the LDAP Account Manager web application exists due to the failure to take measures to neutralize certain special elements. Exploiting this vulnerability allows a malicious actor to use the user’s username field to manipulate LDAP data...

CVE-2022-33023

CVA6 commit 909d85a gives incorrect permission to use special multiplication units when the format of instructions is wrong...

CVE-2022-33023

CVE-2022-33023 affects the OpenHW CVA6 CPU. The issue originates from commit 909d85a, which “gives incorrect permission to use special multiplication units when the format of instructions is wrong.” The connected records corroborate this description across Red Hat, NVD, CVE lists, and regional no...

CVE-2022-33023

CVA6 commit 909d85a gives incorrect permission to use special multiplication units when the format of instructions is wrong...

The vulnerability of the WWebView component of MCE Systems’ mobile device lifecycle management system allows a hacker to execute arbitrary commands.

The vulnerability of MCE Systems’ WWebView component in mobile device lifecycle management systems lies in the lack of measures taken to neutralize special elements used by the operating system when processing the value parameter. Exploiting this vulnerability allows an attacker to execute...

CVE-2022-2238

A vulnerability was found in the search-api container when a query in the search filter gets parsed by the backend. This flaw allows an attacker to craft specific strings containing special characters that lead to crashing the pod and affects system availability while restarting...

Insecure Signature Verification

jsrsasign is vulnerable to insecure signature verification. The vulnerability exists because the library does not properly validate the JWS or JWT signature with non-Base64URL encoding special characters or number escaped characters such as !@$% or \11...

Secheron SEPCOS Control and Protection Relay Elevation of Privilege Vulnerability

Secheron SEPCOS Control and Protection Relay is a relay from Secheron. Control and protect your DC panels and contact lines from short circuits and other electrical faults, and benefit from enhanced communication capabilities.An elevation of privilege vulnerability exists in the Secheron SEPCOS...