CVE-2022-23451

An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data,...

WS-2022-0271

Modify other people's articles by modifying the data package in cherry-toto/jizhicms. The program does not check whether the originator of the request has this permission. I can modify the content of other people's articles and even modify the content by capturing data packets, even if I am not t...

HPESBHF04333 rev.4 - HPE Integrated Lights-Out 5 (iLO 5), Multiple Vulnerabilities

Potential Security Impact: Local: Arbitrary Code Execution, Denial of Service DoS, Disclosure of Sensitive Information, Unauthorized Data Modification SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers - Prior to 2.71 HPE Apollo...

CVE-2022-21557

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Web Container. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracl...

CVE-2022-21508

Vulnerability in Oracle Essbase component: Security and Provisioning. The supported version that is affected is 21.3. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase. Successful attacks...

CVE-2022-21455

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: PAM Auth Plugin. Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...

Oracle Database Server 安全漏洞

Oracle Database Server is a set of relational database management system of Oracle Oracle. The database management system provides data management, distributed processing, etc. Java VM is one of the Java virtual machine components. A security vulnerability exists in Oracle Database Server, which...

CVE-2021-31677

An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that can modify admin and other members' passwords...

PT-2022-20506

Name of the Vulnerable Software and Affected Versions octopoller version 0.2.0 Description The issue arises from the octopoller gem being packed with files having their permissions set to -rw-rw-rw- i.e. 0666 instead of rw-r--r-- i.e. 0644 in version 0.2.0. This means that everyone who is not the...

CVE-2022-25878

CVE-2022-25878 affects protobufjs with Prototype Pollution (Object.prototype) via untrusted input to util.setProperty, ReflectionObject.setParsedOption, or .proto parsing. Connected docs show a related entry (CVE-2023-36665) describing protobufjs 6.10.0–7.x before 7.2.5 as vulnerable to prototype...

GHSA-H4XC-577P-HGJ9 Magento cross-site request forgery (CSRF) vulnerability via the GraphQL API

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are affected by a cross-site request forgery CSRF vulnerability via the GraphQL API. Successful exploitation could lead to unauthorized modification of customer metadata by an unauthenticated attacker. Access to the...

PT-2022-30763

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.311 Description The issue concerns a problem where dirty pages can be modified without proper authorization from ext4, potentially leading to security vulnerabilities. The actual impact and likelihood of an...

PT-2022-30696

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.276 Description The issue concerns a problem where dirty pages can be modified without proper authorization from ext4, potentially leading to security vulnerabilities. The actual impact and likelihood of an...

Hyperledger: Unauthorized packages modification or secrets exfiltration via GitHub actions

Thank you to @dustywormwood for working closely with the Iroha team to fix this issue. You can learn more about this vulnerability type at https://github.com/nikitastupin/pwnhub. Thanks to the Hyperledger team for thorough remediation and clear communication!...

CVE-2022-21419

CVE-2022-21419 affects Oracle Fusion Middleware’s Business Intelligence Enterprise Edition (BI EE) , specifically the Visual Analyzer component. Affected are BI EE versions 5.5.0.0.0 and 5.9.0.0.0 . The vulnerability is exploitable over HTTP with network access; although the attacker is unauthent...

Privilege escalation

An attacker can perform a privilege escalation through the SICK OEE if the application is installed in a directory where non authenticated or low privilege users can modify its content...

CVE-2021-39782

In Telephony, there is a possible unauthorized modification of the PLMN SIM file due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2021-39782

In Telephony, there is a possible unauthorized modification of the PLMN SIM file due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

Design/Logic Flaw

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modify customers and to create orders without App Permission. This issue is a result of improper api route checking. Users are advised to upgra...

CVE-2022-23709

A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to create new alerting rules or overwrite existing ones. However, any new or modified rules would not be enabled, and a user with this...