PT-2022-7388 · Parallels · Parallels Desktop

Name of the Vulnerable Software and Affected Versions: Parallels Desktop affected versions not specified Description: This issue allows local attackers to downgrade Parallels software on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target...

Debian: Security Advisory (DLA-3205-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-43983 Browsershot 3.57.2 - Server Side XSS to LFR via HTML

Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the HTML content passed to the Browsershot::html method does not contain URL's that use the file:// protocol...

Spatie Browsershot 跨站脚本漏洞

Spatie Browsershot is a codebase based on Php, Javascript that converts browser pages into PDF or image formats by the Belgian Spatie team. A security vulnerability exists in Spatie Browsershot version 3.57.2, which stems from not validating the URL protocol passed to the Browsershot::url method,...

Internet Bug Bounty: CVE-2022-45402: Apache Airflow: Open redirect during login

In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's /login endpoint. my initial email to [email protected]: Hi, In Apache Airflow, there is a parameter "next" on the Login page. And after a successful login, we're redirected to this parameter's value. I see...

Boa SQL注入漏洞

Boa is open source an open source code for embedded applications. A SQL injection vulnerability exists in Boa version 0.94.14rc21. The vulnerability stems from the username parameter not being validated for external input. An attacker can exploit this vulnerability to obtain sensitive database...

MyBB 跨站脚本漏洞

MyBB MyBulletinBoard is a free and web-based forum software developed by MYBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. A cross-site scripting vulnerability exists in versions prior to mybb MyBB 1.8.32, which stems from a...

Billing System Project SQL注入漏洞

Billing System Project is a billing system project by Mayuri K. Individual developer. Billing System Project v1.0 suffers from a SQL injection vulnerability that stems from a lack of validation of the endDate parameter in getOrderReport.php against an externally entered SQL statement. An attacker...

CVE-2022-3634

The Contact Form 7 Database Addon WordPress plugin before 1.2.6.5 does not validate data when output it back in a CSV file, which could lead to CSV injection...

Tenda AC18 安全漏洞

The Tenda AC18 is a router from the Chinese company Tenda. A buffer overflow vulnerability exists in Tenda AC18 version V15.03.05.19, which is caused by the formWifiWpsOOB function not checking the length of the input data, and can be exploited to cause a denial of service...

WordPress plugin Booster for WooCommerce 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

PT-2022-23316 · WordPress · Contact Form 7 Database Addon

Name of the Vulnerable Software and Affected Versions: Contact Form 7 Database Addon WordPress plugin versions prior to 1.2.6.5 Description: The issue concerns the Contact Form 7 Database Addon WordPress plugin, which does not validate data when outputting it back in a CSV file. This could lead t...

PT-2022-5726 · Cisco · Cisco Identity Services Engine

Name of the Vulnerable Software and Affected Versions: Cisco Identity Services Engine affected versions not specified Description: A vulnerability in the web-based management interface could allow an authenticated, remote attacker to conduct cross-site scripting attacks against other users of the...

CVE-2022-38201

An unvalidated redirect vulnerability exists in Esri Portal for ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1. A remote, unauthenticated attacker can potentially induce an unsuspecting authenticated user to access an an attacker controlled domain...

CVE-2022-38201

An unvalidated redirect vulnerability exists in Esri Portal for ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1. A remote, unauthenticated attacker can potentially induce an unsuspecting authenticated user to access an an attacker controlled domain...

Open redirect

An unvalidated redirect vulnerability exists in Esri Portal for ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1. A remote, unauthenticated attacker can potentially induce an unsuspecting authenticated user to access an an attacker controlled domain...

CVE-2022-38201 An unvalidated redirect vulnerability exists in Esri ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1.

An unvalidated redirect vulnerability exists in Esri Portal for ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1. A remote, unauthenticated attacker can potentially induce an unsuspecting authenticated user to access an an attacker controlled domain...

PT-2022-24278 · Esri · Esri Portal For Arcgis Quick Capture Web Designer

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS Quick Capture Web Designer versions 10.8.1 through 10.9.1 Description: An unvalidated redirect issue exists, allowing a remote, unauthenticated attacker to potentially trick an authenticated user into accessing a domain...

grub2 缓冲区错误漏洞

grub2 is a Linux system boot program from the American GNU community. grub2 suffers from a buffer error vulnerability that stems from its font code presenting certain unicode sequences when it fails to properly validate the width and height of a font. These values are further used to access the...

CVE-2022-38201 An unvalidated redirect vulnerability exists in Esri ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1.

An unvalidated redirect vulnerability exists in Esri Portal for ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1. A remote, unauthenticated attacker can potentially induce an unsuspecting authenticated user to access an an attacker controlled domain...