CVE-2022-2198

The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displaying private messages, allowing any logged in user to read other users private message using the message id, which can easily be brute forced...

WordPress plugin WPQA Builder 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

MingSoft MCMS SQL注入漏洞

MingSoft MCMS is a complete open source J2ee system from China's MingSoft. A SQL injection vulnerability exists in MingSoft MCMS version 5.2.8, which originates from a SQL injection vulnerability in the /mdiy/model/delete URI containing a SQL injection via models Lists...

MingSoft MCMS SQL注入漏洞

MingSoft MCMS is a complete open source J2ee system from China's MingSoft. A SQL injection vulnerability exists in MingSoft MCMS version 5.2.8, which originates from an attacker being able to exploit the fieldName parameter of its /mdiy/page/verify URI component to achieve SQL injection...

DEBIAN-CVE-2022-35948

undici is an HTTP/1.1 client, written from scratch for Node.js.= [email protected] users are vulnerable to CRLF Injection on headers when using unsanitized input as request headers, more specifically, inside the content-type header. Example: import request from 'undici' const unsanitizedContentTypeInp...

Eyes of Network Web 跨站请求伪造漏洞

Eyes of Network Web is a global regulatory solution for hardware status of devices, operating systems, standard applications, business applications and performance from the Eyes of Network Web community. A security vulnerability exists in Eyes of Network Web version 5.3, which stems from a lack o...

Nordic Semiconductor nRF5 SDK 缓冲区错误漏洞

The Nordic Semiconductor nRF5 SDK is a software development kit from Nordic Semiconductor, Norway. It provides a rich development environment for the nRF51 and nRF52 family of SoCs. A security vulnerability exists in Nordic Semiconductor nRF5 SDK version 5.0, which is caused by a heap overflow...

CVE-2022-35587

A cross-site scripting XSS issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publishondate" Parameter...

PT-2022-22865 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad version 5.2.0 Description: The issue allows customers with secondary organizations assigned to view all organizations in the system, rather than only those they are assigned to. Recommendations: For Zammad version 5.2.0, at the moment,...

Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad version 5.2.0, which stems from a flaw in its login credentials brute force feature that causes an attacker to bypass the feature's limitations before attempting a certain...

GHSA-763J-Q7WV-VF3M JSPUI's controlled vocabulary feature vulnerable to Open Redirect before v6.4 and v5.11

Impact The JSPUI controlled vocabulary servlet is vulnerable to an open redirect attack, where an attacker can craft a malicious URL that looks like a legitimate DSpace/repository URL. When that URL is clicked by the target, it redirects them to a site of the attacker's choice. This vulnerability...

org.dspace.modules:jspui (>=5.0 <=5.10) potentially affected by CVE-2022-31192 via org.dspace:dspace-jspui (>=5.0 <=5.10)

org.dspace:dspace-jspui MAVEN version =5.0, =5.0, =5.10 Source cves: CVE-2022-31192 Source advisory: OSV:GHSA-4WM8-C2VV-XRPQ...

CLSA-2022-1659636700 Fix CVE(s): CVE-2022-21515

SECURITY UPDATE: Update to 5.7.39 to fix security issues - CVE-2022-21515 - debian/patches/disabletests.patch: added new failing test with 5.7.39...

ITPison OMICARD EDM 路径遍历漏洞

ITPison OMICARD EDM is a high-speed email newsletter EDM marketing and distribution system from ITPison China. A security vulnerability exists in ITPison OMICARD EDM versions v5.8 to v6.0. The vulnerability stems from a path traversal in OMICARD EDM's Mail Image Forwarding feature, which can be...

CVE-2022-34928

JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via /system/user...

Trend Micro VPN Proxy Pro 安全漏洞

Trend Micro VPN Proxy Pro is one of the best virtual private network services from Trend Micro. A security vulnerability exists in Trend Micro VPN Proxy Pro version 5.2.1026 and prior versions. A local attacker could exploit the vulnerability to gain elevation of privilege on affected systems...

Desdev DedeCMS 安全漏洞

Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has content publishing, content management, content editing and content retrieval functions. A security vulnerability exists in...

DENSO WAVE QR Code Generator 路径遍历漏洞

DENSO WAVE QR Code Generator is a QR code generator from DENSO WAVE Japan. A security vulnerability exists in DENSO WAVE QR Code Generator version v5.2.7. An attacker can exploit the vulnerability to perform directory traversal...

WordPress plugin WP Visitor Statistics SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

UBUNTU-CVE-2022-31151

Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There are active users using cookie headers in undici. This may lead to accidental leakage of cookie to a 3rd-party site or...