CVE-2021-3701

A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. This flaw allows an attacker to pre-create the directory, resulting in reading private information or forcing ansible-runner to write files as the legitimate use...

Ansible Runner 安全漏洞

Ansible Runner is an open source tool and python library for Ansible. It can help when interacting with Ansible directly or as part of another system. A security vulnerability in Ansible Runner version 2.0.0, which stems from the default temporary file configuration being written to a world R/W...

PT-2022-10610 · Unknown · Ansible-Runner

Name of the Vulnerable Software and Affected Versions: ansible-runner affected versions not specified Description: A race condition flaw was found, allowing an attacker to potentially access ansible-runner's private data dir by substituting their directory at the name of a temporary directory. Th...

PT-2022-23820 · Bluecms · Bluecms

Name of the Vulnerable Software and Affected Versions: BlueCMS version 1.6 Description: The issue is related to SQL injection, specifically located in line 55 of the admin/model.php file. Recommendations: For BlueCMS version 1.6, consider restricting access to the admin/model.php file until a pat...

Ansible Runner 竞争条件问题漏洞

Ansible Runner is an open source tool and python library for Ansible. It can help when interacting with Ansible directly or as part of another system. A security vulnerability exists in Ansible Runner version 2.0.0, which stems from the presence of a race condition vulnerability that can be...

PT-2022-10609 · Unknown · Ansible-Runner

Name of the Vulnerable Software and Affected Versions: ansible-runner version 2.0.0 Description: A flaw was found in ansible-runner where the default temporary files configuration is written to world R/W locations. This flaw allows an attacker to pre-create the directory, resulting in reading...

PT-2022-21204 · Wwbn · Avideo

Name of the Vulnerable Software and Affected Versions: WWBN AVideo versions 11.6 WWBN AVideo dev master commit 3f7c0364 Description: An issue exists in the login functionality due to an improper password check. This allows an attacker with a user's password hash to directly log into the account,...

Post SMTP < 2.1.4 - Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfilteredhtml capability is disallowed. Put the following payload in the Post SMTP Settings...

PT-2022-23897 · Unknown · Dolphinphp

Name of the Vulnerable Software and Affected Versions: DolphinPHP version 1.5.1 Description: The issue concerns Cross Site Scripting XSS via the Background - System - system function - configuration management. This allows for potential malicious script injection. Recommendations: For DolphinPHP...

PT-2022-22602 · Unknown · Kkfileview

Name of the Vulnerable Software and Affected Versions: kkFileView version 4.1.0 Description: The issue is related to multiple cross-site scripting XSS vulnerabilities. These vulnerabilities can be exploited via the urls and currentUrl parameters at the /controller/OnlinePreviewController.java...

PT-2022-4364 · Ge Digital · Proficy Machine Edition

Name of the Vulnerable Software and Affected Versions: Proficy Machine Edition versions 9.00 and prior Description: The issue is related to an unrestricted upload of files with dangerous types. This allows an attacker to upload and execute malicious files in the target system. The vulnerability i...

PT-2022-23495 · Mingsoft · Mingsoft Mcms

Name of the Vulnerable Software and Affected Versions: Mingsoft MCMS version 5.2.8 Description: A SQL injection issue was found in the /mdiy/model/delete URI via models Lists. This could potentially allow for unauthorized access to database information. Recommendations: For Mingsoft MCMS version...

PT-2022-23446 · D Link · D-Link Go-Rt-Ac750

Name of the Vulnerable Software and Affected Versions: D-Link Go-RT-AC750 versions GORTAC750 revA v101b03 through GO-RT-AC750 revB FWv200b02 Description: The issue is related to a Buffer Overflow that can occur via the authenticationcgi main function. This can potentially allow for unauthorized...

PT-2022-23447 · D Link · D-Link Go-Rt-Ac750

Name of the Vulnerable Software and Affected Versions: D-Link GO-RT-AC750 versions GORTAC750 revA v101b03 through GO-RT-AC750 revB FWv200b02 Description: The issue concerns an authentication bypass. It is related to the function phpcgi main in cgibin. Recommendations: For D-Link GO-RT-AC750 versi...

PT-2022-23057 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest stable, beta and tests-passed versions Description: A malicious user can exploit the invitation system to spam arbitrary email addresses by sending them invitation emails in certain cases. The estimated...

PT-2022-22914 · Fork Cms · Fork Cms

Name of the Vulnerable Software and Affected Versions: ForkCMS version 5.9.3 Description: A cross-site scripting XSS issue allows remote attackers to inject JavaScript via the end date Parameter. This issue was patched in version 5.11.0, which implies that versions prior to 5.11.0 are affected...

sqlite (>=0.19.7, <=0.21.1), sqlite3-sys (>=0.6.7, <=0.9.2) +3 more potentially affected by unknown CVE via temporary (0.5.1)

temporary CARGO version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on temporary and may be impacted: - sqlite =0.19.7, =0.6.7, =0.11.0, =0.2.6, =0.2.7 Source cves: unknown CVE Source advisory: OSV:GHSA-2JQ9-6XX7-3H29...

`temporary` makes use of uninitialized memory

Uninitialized memory is used as a RNG seed in temporary. This has been resolved in the 0.6.4 release. The crate is not intended to be used outside of a testing environment. For a general purpose crate to create temporary directories, tempfile is an alternative for this crate...

GHSA-2JQ9-6XX7-3H29 `temporary` makes use of uninitialized memory

Uninitialized memory is used as a RNG seed in temporary. This has been resolved in the 0.6.4 release. The crate is not intended to be used outside of a testing environment. For a general purpose crate to create temporary directories, tempfile is an alternative for this crate...

PT-2022-14553 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android version 13 Description: There is a possible way to retrieve the WiFi SSID without location permissions due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User...