CLSA-2022-1643291562 Fix of CVE: CVE-2021-4034

CVE-2021-4034: polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector...

CVE-2021-46385

https://gitee.com/mingSoft/MCMS MCMS =5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information remote. The component is: net.mingsoft.mdiy.action.FormDataActionqueryData. The attack vector is: 0 or sleep3. ¶¶ MCMS has a sql injection vulnerability through which attacker ca...

Sql injection

https://gitee.com/mingSoft/MCMS MCMS =5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information remote. The component is: net.mingsoft.mdiy.action.FormDataActionqueryData. The attack vector is: 0 or sleep3. ¶¶ MCMS has a sql injection vulnerability through which attacker ca...

CVE-2021-46385

https://gitee.com/mingSoft/MCMS MCMS =5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information remote. The component is: net.mingsoft.mdiy.action.FormDataActionqueryData. The attack vector is: 0 or sleep3. ¶¶ MCMS has a sql injection vulnerability through which attacker ca...

CVE-2021-46383

https://gitee.com/mingSoft/MCMS MCMS =5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information remote. The component is: net.mingsoft.mdiy.action.web.DictActionlist. The attack vector is: 0 or sleep3. ¶¶ MCMS has a sql injection vulnerability through which attacker can get...

CLSA-2022-1643212149 Fix of CVE: CVE-2021-4034

CVE-2021-4034: polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector...

CVE-2021-44118

SPIP 4.0.0 is affected by a Cross Site Scripting XSS vulnerability. To exploit the vulnerability, a visitor must browse to a malicious SVG file. The vulnerability allows an authenticated attacker to inject malicious code running on the client side into web pages visited by other users stored XSS...

DEBIAN-CVE-2021-44118

SPIP 4.0.0 is affected by a Cross Site Scripting XSS vulnerability. To exploit the vulnerability, a visitor must browse to a malicious SVG file. The vulnerability allows an authenticated attacker to inject malicious code running on the client side into web pages visited by other users stored XSS...

UBUNTU-CVE-2021-44118

SPIP 4.0.0 is affected by a Cross Site Scripting XSS vulnerability. To exploit the vulnerability, a visitor must browse to a malicious SVG file. The vulnerability allows an authenticated attacker to inject malicious code running on the client side into web pages visited by other users stored XSS...

PT-2022-5417 · Corel · Coreldraw Graphics Suite

Name of the Vulnerable Software and Affected Versions: Corel CorelDRAW Graphics Suite version 23.5.0.506 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a...

Huawei AIS-BW80H-00: Command Injection Vulnerability

Huawei AIS-BW80H-00 is a smart speaker device from Huawei China. Huawei AIS-BW80H-00 is vulnerable to a command injection vulnerability caused by the device's inability to effectively defend against malicious outside interference. A local attacker could exploit the vulnerability to pass specially...

polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters coun...

CodeIgniter: Cross-site Scripting Vulnerabilities

CodeIgniter is an open source web framework written in the PHP language. CodeIgniter 4 suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

Fedora: Security Advisory for qt5-qtsvg (FEDORA-2022-8e3fbc74e9)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2022-21344

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Replication. Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL...

convert-svg path traversal vulnerability

convert-svg is open source series of open source software for converting SVG format files to other formats. A security vulnerability exists in convert-svg, which can be exploited by an attacker to read an arbitrary file from the filesystem via a carefully constructed SVG file and then display the...

PT-2022-7035 · Reolink · Reolink Rlc-410W

Name of the Vulnerable Software and Affected Versions: Reolink RLC-410W version 3.0.0.136 20121102 Description: A memory corruption issue exists in the netserver parse command list functionality, related to an out-of-bounds write operation. This can be triggered by a specially-crafted HTTP reques...

CVE-2022-21353

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogi...

Design/Logic Flaw

Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: General. Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where th...

CVE-2022-21349

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated...