4747 matches found
CVE-2022-24295
Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially crafted URL...
AZL-8610 CVE-2021-44141 affecting package samba 4.12.5-7
All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succee...
NPM url-parse 安全漏洞
Url-Parse is a small Url parser that works seamlessly across Node.js and browser environments.An authorization bypass vulnerability exists in versions of NPM url-parse prior to 1.5.8, which can be exploited by attackers to bypass authorization via a user-controlled key...
CVE-2022-0660
Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11...
CVE-2022-25242
In FileCloud before 21.3, file upload is not protected against Cross-Site Request Forgery CSRF...
AZL-8604 CVE-2022-25236 affecting package expat for versions less than 2.4.8-1
xmlparse.c in Expat aka libexpat before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs...
Expat 输入验证错误漏洞
Expat is a fast streaming XML parser written in C. A security vulnerability existed prior to Expat 2.4.5, which could be exploited by attackers to insert namespace separators into namespace URIs...
CVE-2022-0596
Improper Validation of Specified Quantity in Input in Packagist microweber/microweber prior to 1.2.11...
CVE-2022-0589
Cross-site Scripting XSS - Stored in Packagist librenms/librenms prior to 22.1.0...
PT-2022-17135 · Jenkins · Jenkins Autonomiq Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins autonomiq Plugin versions 1.15 and earlier Description: A missing permission check in the Jenkins autonomiq Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified...
PT-2022-17126 · Hashicorp +1 · Jenkins Hashicorp Vault Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins HashiCorp Vault Plugin versions 3.8.0 and earlier Description: The issue allows agent processes to retrieve any Vault secrets for use on the agent. Attackers able to control agent processes can obtain Vault secrets for an...
CVE-2022-0575
Cross-site Scripting XSS - Stored in Packagist librenms/librenms prior to 22.2.0...
CVE-2022-0570
Heap-based Buffer Overflow in Homebrew mruby prior to 3.2...
CVE-2022-0208
The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error message, leading to a Reflected Cross-Site Scripting...
CVE-2021-25115
The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting XSS. Error log content was handled improperly, therefore any user, even unauthenticated, could cause arbitrary javascript to be executed in the admin panel...
CVE-2021-25014
The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ivesavegeneralsettings AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings which could lead to Stored Cross-Site Scripting issue...
IBM Cognos Analytics 跨站脚本漏洞
IBM Cognos Analytics is a suite of business intelligence software from IBM Corporation. IBM Cognos Analytics Mobile for Android is vulnerable to cross-site scripting, which originates from IBM Cognos Analytics Mobile before version 1.1.14. Android applications are vulnerable to cross-site scripti...
WordPress和WordPress plugin SQL注入漏洞
WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers.A SQL injection vulnerability exists in versions prior to WordPress Ad Invalid Click Protector AICP plugin 1.2.6, which stems from ...