Cockpit Access Control Error Vulnerability

Cockpit is an interactive server management interface. An access control error vulnerability exists in Cockpit versions prior to 2.2.0 that stems from insufficient session expiration. An attacker could exploit the vulnerability to take control of an account using expired session credentials...

Cockpit before 2.2.0 vulnerable to Insufficient Session Expiration

Cockpit before version 2.2.0 is vulnerable to Insufficient Session Expiration. The application does not validate requests after password changes, allowing a user to change their account details even after an admin changes their password...

CVE-2022-2713

Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0...

PT-2022-18527 · Synology · Synology Usb Copy

Name of the Vulnerable Software and Affected Versions: Synology USB Copy versions prior to 2.2.0-1086 Description: The issue is related to a Path Traversal vulnerability in the webapi component, allowing remote authenticated users to read or write arbitrary files via unspecified vectors...

Synology USB Copy 路径遍历漏洞

Synology USB Copy from Synology China helps you copy files between Synology NAS and external USB/SD storage devices. A path traversal vulnerability exists in Synology USB Copy versions prior to 2.2.0-1086, which stems from an improper restriction on the pathname of a restricted directory in the...

Jenkins Repository Connector Plugin 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

Missing permission check in repository-connector allows listing the Jenkins controller file system

repository-connector 2.2.0 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. A sequence of requests can b...

GHSA-JXVF-M3X5-MXWQ Properties-Reader before v2.2.0 vulnerable to prototype pollution

Properties-Reader prior to version 2.2.0 is vulnerable to prototype pollution. Version 2.2.0 contains a patch for this issue...

CVE-2022-1761

The Peter’s Collaboration E-mails WordPress plugin through 2.2.0 is vulnerable to CSRF due to missing nonce checks. This allows the change of its settings, which can be used to lower the required user level, change texts, the used email address and more...

CVE-2021-35531 Remote Code Execution in TXpert Hub CoreTec 4

Improper Input Validation vulnerability in a particular configuration setting field of Hitachi Energy TXpert Hub CoreTec 4 product, allows an attacker with access to an authorized user with ADMIN or ENGINEER role rights to inject an OS command that is executed by the system. This issue affects:...

Sql injection

SQL Injection in GitHub repository camptocamp/terraboard prior to 2.2.0...

Terraboard sql injection vulnerability

Terraboard is a web panel for visualizing and querying Terraform status. sql injection vulnerability exists in versions prior to Terraboard 2.2.0, which can be exploited by attackers to conduct SQL injection attacks...

GHSA-M8R4-C7JM-W782 Jenkins Plugin Installation Manager Tool did not verify plugin downloads

Jenkins Plugin Installation Manager Tool is part of the Jenkins project Docker images. As jenkins-plugin-cli it is used to download and install plugins even before Jenkins is running. Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads. This may allow third...

GHSA-5Q37-9874-QXCW Mattermost Server exposes information stored by a web browser

An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser...

Mattermost Server is vulnerable to XSS through crafted links

An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link...

GHSA-RM24-25XM-9454 Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution

An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window...

PT-2022-19733 · Unknown · Connect-Multiparty

Name of the Vulnerable Software and Affected Versions: Connect-Multiparty version 2.2.0 Description: An arbitrary file upload vulnerability in the file upload module allows attackers to execute arbitrary code via a crafted PDF file. Recommendations: For Connect-Multiparty version 2.2.0, consider...

GHSA-J88V-Q3VW-P9VR Deserialization of Untrusted Data in Flamingo amf-serializer

The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this vulnerability...

OpenEXR invalid read

In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash...

PT-2022-18864 · Brocade · Brocade Sannav

Name of the Vulnerable Software and Affected Versions: Brocade SANNav versions prior to 2.2.0 Description: A vulnerability in the role-based access control RBAC functionality could allow an authenticated, remote attacker to access resources that they should not be able to access and perform actio...