IBM Cognos Analytics 日志信息泄露漏洞

IBM Cognos Analytics is a suite of business intelligence software from IBM in the United States. The software includes reports, dashboards, and scorecards, and can assist companies in adjusting their decisions by analyzing such things as key factors and key people. A sensitive information...

CVE-2022-4607

A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to xml external entity reference. Upgrading to version 5.2.1 is able to address this issue. The name of the patch...

CVE-2022-20503

creationtimestamp| type| source ---|---|--- 2022-12-16 18:37:40+00:00| seen| https://t.me/cibsecurity/54739...

INEX IXP-Manager 安全漏洞

IXP Manager is a full-stack web application from INEX open source. It supports peer-to-peer operations for about 200 Internet Exchange Points IXPs worldwide. A security vulnerability exists in INEX IXP-Manager version 6.2.0 and earlier versions. An attacker exploited the vulnerability to perform...

PT-2022-35693 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.220 Description: A potential security issue has been identified in the Linux Kernel, related to the cpuinfo module. The actual impact and attack plausibility have not yet been proven. Recommendations: For...

Pillow 安全漏洞

Pillow is a Python based image processing library. A security vulnerability exists in Pillow versions prior to 9.2.0, which stems from improper handling of highly compressed GIF data...

Race condition allowing privilege escalation

Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint under heavy load. This issue is patche...

CVE-2022-2720

creationtimestamp| type| source ---|---|--- 2022-10-12 12:40:50+00:00| seen| https://t.me/cibsecurity/51256...

IBM Sterling Partner Engagement Manager 授权问题漏洞

A security vulnerability in IBM Sterling Partner Engagement Manager version 2.0, an automated management tool from International Business Machines Corporation IBM, stems from a failure to invalidate sessions after logging out, which could allow an authenticated user to impersonate another user on...

CVE-2014-0144

QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overflows or crash caused by missing input validations which could allow a remote user to execute arbitrary code on the host with the privilege...

CVE-2022-38061 WordPress Export Post Info plugin <= 1.2.0 - Authenticated CSV Injection vulnerability

Authenticated author+ CSV Injection vulnerability in Export Post Info plugin = 1.2.0 at WordPress...

Pixel＆tonic Craft CMS 跨站脚本漏洞

Pixel & tonic Craft CMS is a content management system CMS from the US company Pixel & tonic. A cross-site scripting vulnerability exists in Craft CMS version 4.2.0.1, which stems from a security issue in the src/helpers/Cp.php page...

Microsoft SPNEGO Extended Negotiation 安全漏洞

Microsoft SPNEGO Extended Negotiation is a SPNEGO extension from Microsoft Corporation USA. A security vulnerability exists in Microsoft SPNEGO Extended Negotiation. The following products and editions are affected: Windows 8.1 for x64-based systems,Windows RT 8.1,Windows Server 2008 R2 for...

CVE-2022-26114

An improper neutralization of input during web page generation vulnerability CWE-79 in the Webmail of FortiMail before 7.2.0 may allow an unauthenticated attacker to trigger a cross-site scripting XSS attack via sending specially crafted mail messages...

CVE-2020-4301

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 176609...

CVE-2022-36558

Seiko SkyBridge MB-A100/A110 v4.2.0 and below implements a hard-coded passcode for the root account. Attackers are able to access the passcord via the file /etc/ciel.cfg...

Seiko Solutions SkyBridge MB-A100/A110 命令注入漏洞

The Seiko Solutions SkyBridge MB-A100/A110 is an LTE-compatible IoT router from Seiko Solutions, Japan. A security vulnerability exists in the Seiko Solutions SkyBridge MB-A100/A110 v4.2.0 and earlier, which is caused by a command injection in the Ping parameter in pingexec.cgi...

GHSA-QMHJ-M29V-GVMR Bots using py-cord as Discord API wrapper are vulnerable to shutdowns through remote code execution

Impact py-cord is a an API wrapper for Discord written in Python. Bots using py-cord version 2.0.0 are vulnerable to remote shutdown if they are added to the server with the application.commands scope without the bot scope. Currently, it appears that all public bots that use slash commands are...

CVE-2021-42052

creationtimestamp| type| source ---|---|--- 2022-08-17 02:39:29+00:00| seen| https://t.me/cibsecurity/48268...

OpenSearch Security 安全漏洞

OpenSearch Security is an OpenSearch plugin for providing encryption, authentication and authorization. A security vulnerability exists in OpenSearch Security version 2.0.0.0, 2.1.0.0. An attacker has exploited the vulnerability to disclose sensitive information...