GHSA-JVC3-WJF6-7C6C Apache Dolphin Scheduler has insufficiently protected credentials

When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher...

PT-2022-27525 · Unknown · Alarm Instance Management

Name of the Vulnerable Software and Affected Versions: Alarm instance management versions prior to 2.0.6 Description: The issue is related to command injection in alarm instance management when a specific command is configured, affecting only logged-in users. Recommendations: For versions prior t...

Jenkins Plugin Config Rotator 路径遍历漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A path traversal...

Huawei HarmonyOS 缓冲区错误漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a microkernel-based distributed operating system. Huawei HarmonyOS version 2.0 and 2.1 of the HwAirlink module are vulnerable to an out-of-bounds read vulnerability that could be exploited by attackers to obtain sensitive...

CVE-2022-38550

A stored cross-site scripting XSS vulnerability in the /weibo/list component of Jeesns v2.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

多款 ZITADEL 产品 安全漏洞

ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the age of containers and serverless, open sourced by ZITADEL in Switzerland. ZITADEL suffers from a security vulnerability that stems from a lack of authorization checks, where Actions is abl...

PT-2022-23253 · Centreon · Centreon

Name of the Vulnerable Software and Affected Versions: Centreon version 22.04.0 Description: The issue is related to a Cross Site Scripting XSS attack. It can be exploited from the function Pollers Broker Configuration by adding a crafted payload into the name parameter. This allows for the...

OmniAuth 安全漏洞

OmniAuth is an authentication system implemented using Rack middleware. A security vulnerability exists in OmniAuth versions prior to 2.0, which stems from lib/omniauth/failureendpoint.rb not escaping the messagekey value...

August 9, 2022-Security and Quality Rollup for .NET Framework 2.0, 3.0, 4.6.2 for Windows Server 2008 SP2 (KB5016741)

August 9, 2022-Security and Quality Rollup for .NET Framework 2.0, 3.0, 4.6.2 for Windows Server 2008 SP2 KB5016741 Applies to:Microsoft .NET Framework 2.0 Microsoft .NET Framework 3.0 Microsoft .NET Framework 4.6.2 IMPORTANT Verify that you have installed the required updates listed in the How t...

CVAT 代码问题漏洞

CVAT is an interactive video and image annotation tool for computer vision. A code issue vulnerability exists in versions of CVAT prior to 2.0.0, which stems from a url used in a code path without added validation...

DRUPAL-CONTRIB-2022-050

This module enables you to generate PDF versions of content. Some installations of the module make use of the dompdf/dompdf third-party dependency. Security vulnerabilities exist for versions of dompdf/dompdf before 2.0.0 as described in the 2.0.0 release notes...

PT-2022-4020 · Jenkins · Jenkins Compuware Source Code Download For Endevor +1

Name of the Vulnerable Software and Affected Versions: Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin versions 2.0.12 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware...

CVE-2022-29709

CommuniLink Internet Limited CLink Office v2.0 was discovered to contain multiple SQL injection vulnerabilities via the username and password parameters...

GNU SASL 缓冲区错误漏洞

GNU SASL is a GNU community implementation of the Simple Authentication and Security Layer SASL framework and some common SASL mechanisms. A security vulnerability exists in GNU SASL versions prior to 2.0.1 that stems from. Server-side out-of-bounds reads to maliciously authenticated GSS-API...

CVE-2021-44170

A stack-based buffer overflow vulnerability CWE-121 in the command line interpreter of FortiOS before 7.0.4 and FortiProxy before 2.0.8 may allow an authenticated attacker to execute unauthorized code or commands via specially crafted command line arguments...

CVE-2022-2400

External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0...

Hotel Management System 跨站脚本漏洞

Hotel Management System is a hotel management system based MIS project by Prem Chand Saini, an individual developer in India. A cross-site scripting vulnerability exists in Hotel Management System version 2.0. An attacker could exploit this vulnerability to conduct a cross-site scripting attack...

Hotel Management System 跨站脚本漏洞

Hotel Management System is a hotel management system based MIS project by Prem Chand Saini, an individual developer in India. A cross-site scripting vulnerability exists in Hotel Management System version 2.0. An attacker could exploit this vulnerability to conduct a cross-site scripting attack...

LibreHealth EHR 跨站脚本漏洞

LibreHealth EHR is a clinically-focused electronic health record EHR system designed to be both easy to use out of the box and customizable for use in a variety of healthcare settings.LibreHealth EHR 2.0.0 is vulnerable to a cross-site scripting vulnerability for which no detailed vulnerability...

HashiCorp go-getter 输入验证错误漏洞

HashiCorp go-getter is a library for HashiCorp's Go golang for downloading files or directories from various sources using URLs as the primary form of input. An input validation error vulnerability exists in HashiCorp go-getter version 2.0.2 and prior versions, which stems from the inability to...