PUB-A-224545390

In getView of AddAppNetworksFragment.java, there is a possible way to mislead the user about network add requests due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2022-24635 · WordPress · Wp-Affiliate-Platform

Name of the Vulnerable Software and Affected Versions: WP Affiliate Platform plugin for WordPress versions up to, and including, 6.3.9 Description: The issue is due to missing or incorrect nonce validation on various functions, including the affiliates menu method. This allows unauthenticated...

GHSA-G389-RF5P-FG56 Badaso vulnerable to Remote Code Execution (RCE)

Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users...

CVE-2022-41705

Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users...

Denial Of Service (DoS)

freerdp is vulnerable vulnerable to denial of service. The vulnerability exists due to missing input validation in urbdrc channel which allows an attacker to cause an application crash with division by zero...

PT-2022-21881 · Unknown · Microscada X Sys600 +1

Name of the Vulnerable Software and Affected Versions: MicroSCADA Pro affected versions not specified MicroSCADA X SYS600 affected versions not specified Description: An input validation issue exists in the Monitor Pro interface, allowing an authenticated user to perform administrator-level remot...

Hoosk CMS Arbitrary File Upload Vulnerability

Hoosk CMS is a lightweight content management system. Hoosk CMS v1.8.0 suffers from an arbitrary file upload vulnerability that stems from its /attachments component failing to validate uploaded files. An attacker can exploit the vulnerability to remotely execute code...

SUSE-SU-2022:4005-1 Security update for php8

This update for php8 fixes the following issues: - CVE-2022-37454: Fixed buffer overflow in hashupdate on long parameter bug81738 bsc1204577. - CVE-2022-31630: Fixed OOB read due to insufficient input validation in imageloadfont bug81739 bsc1204979. - version update to 8.0.25 27 Oct 2022 Session:...

PT-2022-34991 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue concerns a validation termination record after EXTRA CONTEXT in the kselftest/arm64 component. The actual impact and attack plausibility have not yet been proven. Recommendations: F...

JVN#54728399: TERASOLUNA Global Framework and TERASOLUNA Server Framework for Java (Rich) vulnerable to ClassLoader manipulation

The past versions of TERASOLUNA Global Framework and TERASOLUNA Server Framework for Java Rich are vulnerable to a ClassLoader manipulation vulnerability due to using the old version of Spring Framework which contains the vulnerability. According to the developer, this vulnerability is caused by ...

CVE-2022-30542

Improper input validation in the firmware for some IntelR Server Board S2600WF, IntelR Server System R1000WF and IntelR Server System R2000WF families before version R02.01.0014 may allow a privileged user to potentially enable an escalation of privilege via local access...

CVE-2022-28611

Improper input validation in some IntelR XMMTM 7560 Modem software before version M27560R01.2146.00 may allow a privileged user to potentially enable escalation of privilege via physical access...

SUSE-SU-2022:3954-1 Security update for python-numpy

This update for python-numpy fixes the following issues: - CVE-2017-12852: Fixed missing input validation leading to infinite loops bsc1053963. Bugfixes: - Use update-alternatives for /usr/bin/f2py bsc1199500...

CVE-2022-20445

In processservicesearchrsp of sdpdiscovery.cc, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

PT-2022-5468 · Microsoft · Windows Graphics +1

Name of the Vulnerable Software and Affected Versions: Windows Graphics Component affected versions not specified Description: The issue is related to insufficient input validation in the Windows Graphics Component, which can be exploited by remote attackers to execute arbitrary code. This can be...

CVE-2022-20457

In getMountModeInternal of StorageManagerService.java, there is a possible prevention of package installation due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

Cisco BroadWorks CommPilot 代码问题漏洞

Cisco BroadWorks CommPilot is a carrier-grade unified communications software platform optimized for performance and scale from Cisco, U.S.A. BroadWorks is hosted by service providers and enables the deployment of cloud calls from a common network platform on any type of wired or wireless network...

Cross site request forgery (csrf)

The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to delete, and modify calendars as well as the...

CVE-2022-3776 Restaurant Menu – Food Ordering System – Table Reservation <= 2.3.1 - Cross-Site Request Forgery

The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on several functions called via AJAX actions such as formsaction, setoption...

CandidATS SQL注入漏洞

CandidATS is a free and open source recruiter tracking system from CandidATS India. A security vulnerability exists in CandidATS version 3.0.0 that stems from the application not properly validating the entriesPerPage parameter against SQL injection attacks...