4748 matches found
CVE-2022-40306
The login form /Login in ECi Printanista Hub formerly FMAudit Printscout before 5.5.2 July 2023 performs expensive RSA key-generation operations, which allows attackers to cause a denial of service DoS by requesting that form repeatedly...
MB CONNECT LINE mymbCONNECT24 安全漏洞
MB CONNECT LINE mymbCONNECT24 is an in-house remote maintenance solution for virtual environments from MB CONNECT LINE, Germany. A security vulnerability exists in MB CONNECT LINE mymbCONNECT24, mbCONNECT24, Helmholz myREX24, and myREX24.virtual v2.11.2 and prior versions, which originates from a...
Matrix matrix-appservice-irc 资源管理错误漏洞
matrix-appservice-irc is a bridge for Matrix. This bridge passes all IRC messages to Matrix and all Matrix messages to IRC. A resource management error vulnerability exists in Matrix matrix-appservice-irc prior to version 0.35.0, which stems from an error in the underlying matrix-org/node-irc...
Theonedev Onedev 授权问题漏洞
Theonedev Onedev is a JAVA-based all-in-one DevOps platform from the Theonedev team. The platform supports container build, orchestration, CI, Git management, team collaboration and other features to help developers build a simple, powerful development platform. Theonedev An authorization issue...
CVE-2022-3178
Buffer Over-read in GitHub repository gpac/gpac prior to 2.1.0-DEV...
GPAC 缓冲区错误漏洞
GPAC is an open source multimedia framework. A security vulnerability exists in versions prior to GPAC 2.1.0-DEV, which can be exploited by an attacker to cause a buffer over-read...
PT-2022-24535 · Unknown · Openharmony
Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 3.1.1 Description: The issue allows LAN attackers to bypass permission control, gaining control of the camera service. Recommendations: For OpenHarmony versions prior to 3.1.1, at the moment, there is no...
PT-2022-23361 · Unknown +1 · Openharmony +1
Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 3.1.2 Description: The issue is caused by an incorrect configuration of the cJSON library, leading to a stack overflow vulnerability during recursive parsing. This allows LAN attackers to launch a Denial of Servi...
CVE-2022-37145
The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTrac authentication provider. An unauthenticated remote attacker could perform a bruteforce attack on the login page with no time or attempt limitation in an...
PT-2022-7691 · Tinygltf +2 · Tinygltf +2
Name of the Vulnerable Software and Affected Versions: tinygltf versions prior to 2.6.0 Description: The tinygltf library has an issue related to the use of the C library function wordexp for file path expansion on untrusted paths from input files. This allows for command injection using backtick...
DEBIAN-CVE-2022-36640
influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint...
RosarioSIS 跨站脚本漏洞
RosarioSIS is a free and open source student information system. It is used to manage students, create reports and make the right decisions. A cross-site scripting vulnerability exists in RosarioSIS versions prior to 8.9.3, which stems from a vulnerability in its upload functionality leading to a...
PT-2022-22156 · Dell · Dell Edge Gateway 5200
Name of the Vulnerable Software and Affected Versions: Dell Edge Gateway 5200 EGW versions prior to 1.03.10 Description: The issue allows a local malicious user to potentially exploit an operating system command injection vulnerability. This can be done by using a System Management Interrupt SMI ...
Google Chrome 缓冲区错误漏洞
Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in versions of Google Chrome prior to 105.0.5195.52, which stems from a mix-up in instructions responsible for freeing memory in Layout. An attacker could exploit this vulnerability to...
CVE-2022-2374
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite se...
PYSEC-2022-257
NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity...
DEBIAN-CVE-2022-3016
Use After Free in GitHub repository vim/vim prior to 9.0.0286...
DEBIAN-CVE-2022-2982
Use After Free in GitHub repository vim/vim prior to 9.0.0260...
AZL-37011 CVE-2022-2031 affecting package samba for versions less than 4.18.3-1
A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw to obtain and use tickets to other...