13228 matches found
WordPress WP OAuth2 Server plugin <= 1.0.1 - Authentication Bypass vulnerability
Authentication Bypass vulnerability discovered by Lana Codes in WordPress WP OAuth2 Server plugin versions = 1.0.1. Solution Deactivate and delete. This plugin has been closed as of June 23, 2022 and is not available for download. This closure is temporary, pending a full review...
ShowMyPC 代码问题漏洞
ShowMyPC is a remote access solution from ShowMyPC, Inc. A security vulnerability exists in ShowMyPC that stems from the presence of a DLL hijacking vulnerability. If an attacker overwrites the file %temp%ShowMyPC-ShowMyPC3606wodVPN.dll, it will run any malicious code contained in that file. Unle...
PT-2022-22002 · Unknown · Portal Do Software Publico Brasileiro I3Geo
Name of the Vulnerable Software and Affected Versions: Portal do Software Publico Brasileiro i3geo version 7.0.5 Description: The issue is a cross-site scripting XSS vulnerability. It was discovered via the svg2img.php file. Recommendations: For version 7.0.5, consider disabling access to the...
Huawei EulerOS: Security Advisory for python-pillow (EulerOS-SA-2022-2037)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2022-35171
When a user opens manipulated JPEG 2000 .jp2, jp2k.x3d files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application. The file format details along with their CVE relevant...
WordPress WSM Downloader plugin <= 1.4.0 - Domain Name Restriction Bypass vulnerability
Domain Name Restriction Bypass vulnerability discovered by Raad Haddad in WordPress WSM Downloader plugin versions = 1.4.0. Solution Deactivate and delete. This plugin has been closed as of July 8, 2022 and is not available for download. This closure is temporary, pending a full review...
SAP 3D Visual Enterprise Viewer 输入验证错误漏洞
SAP 3D Visual Enterprise Viewer is a 3D view viewer from SAP, Germany. The software supports the publishing of 2D and 3D scenes in all industry-standard desktop applications and supports separate installations as stand-alone executable programs and ActiveX spaces. An input validation error...
CVE-2022-31138 OS Command Injection in mailcow
mailcow is a mailserver suite. Prior to mailcow-dockerized version 2022-06a, an extended privilege vulnerability can be exploited by manipulating the custom parameters regexmess, skipmess, regexflag, delete2foldersonly, delete2foldersbutnot, regextrans2, pipemess, or maxlinelengthcmd to execute...
openSUSE 15 Security Update : python-ipython (openSUSE-SU-2022:10043-1)
The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2022:10043-1 advisory. - IPython Interactive Python is a command shell for interactive computing in multiple programming languages, originally developed for the Python...
kotlin: vulnerable Java API was used for temporary file and folder creation which could result in information disclosure
In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions...
junit4: TemporaryFolder is shared between all users across system which could result in information disclosure
In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this...
WordPress Flexi Quote Rotator plugin <= 0.9.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Daniel Ruf in WordPress Flexi Quote Rotator plugin versions = 0.9.4. Solution Deactivate and delete. This plugin has been closed as of July 6, 2022 and is not available for download. This closure is temporary, pending a ful...
PT-2022-22223 · Wavlink · Wavlink Wl-Wn575A3
Name of the Vulnerable Software and Affected Versions: Wavlink WL-WN575A3 version RPT75A3.V4300.201217 Description: A command injection issue was discovered, allowing attackers to execute arbitrary commands via a crafted POST request to the obtw function. This enables attackers to send malicious...
Design/Logic Flaw
Frontier is Substrate's Ethereum compatibility layer. In affected versions the truncation done when converting between EVM balance type and Substrate balance type was incorrectly implemented. This leads to possible discrepancy between appeared EVM transfer value and actual Substrate value...
CVE-2022-31111 Discrepency in transfer value and actual value due to incorrect truncation in Frontier
Frontier is Substrate's Ethereum compatibility layer. In affected versions the truncation done when converting between EVM balance type and Substrate balance type was incorrectly implemented. This leads to possible discrepancy between appeared EVM transfer value and actual Substrate value...
netty: Information disclosure via the local system temporary directory
In Netty there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used, a local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the...
mmq.de Cross Site Scripting vulnerability OBB-2705271
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PT-2022-21691 · Unknown +5 · Das U-Boot +5
Name of the Vulnerable Software and Affected Versions: Das U-Boot versions 2020.10 through 2022.07-rc3 Description: The issue is related to an out-of-bounds write via the function sqfs readdir. Recommendations: For Das U-Boot versions 2020.10 through 2022.07-rc3, consider disabling the sqfs readd...
PT-2022-7447 · Net Snmp +8 · Net-Snmp +8
Name of the Vulnerable Software and Affected Versions: net-snmp versions prior to 5.9.2 Description: The issue is related to a NULL pointer dereference in the nsVacmAccessTable component of the net-snmp software. This can be caused by a user with read-write credentials using a malformed OID in a...
