CVE-2022-2433

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to deserialization of untrusted input via the 'almrepeatersexport' parameter in versions up to, and including 5.5.3. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they...

CVE-2022-34747

A format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21AAZF.12C0 could allow an attacker to achieve unauthorized remote code execution via a crafted UDP packet...

WordPress plugin WP Database Backup 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

Softlink Oliver v5 Library Server 安全漏洞

Softlink Oliver v5 Library Server is an easy-to-use library management and learning tool from Softlink. A security vulnerability exists in Softlink Oliver v5 Library Server version 5.00.008.053, which originates from a FileServlet function that allows an attacker to download arbitrary files using...

Wolfssl 安全漏洞

Wolfssl CyaSSL is a small, portable embedded SSL programming library for embedded systems developers from Wolfssl Inc. in the United States. A security vulnerability exists in Wolfssl versions prior to 5.5.0 that stems from the fact that a man-in-the-middle attacker or a malicious server can cras...

Tenda AC6 安全漏洞

Tenda AC6 is a wireless router from Tenda China. A security vulnerability exists in Tenda AC6 AC1200 v5.0 Firmware v02.03.01.114 and below, which originates from a problem in the component /cgi-bin/DownloadFlash and allows attackers to steal all data, such as source code and system files, via a...

PT-2022-23462 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6AC1200 v5.0 Firmware versions v02.03.01.114 and below Description: The issue affects the /cgi-bin/DownloadFlash component, allowing attackers to steal data such as source code and system files via a crafted GET request...

SiteServerCMS 安全漏洞

SSCMS SiteServerCMS SSCMS is an open source, cross-platform, enterprise-level content management system from China's SSCMS Corporation. A security vulnerability exists in SiteServerCMS version 5.X. The vulnerability stems from a remote download Getshell vulnerability via...

CVE-2022-37223

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinalcms/system/role/list...

jfinal cms SQL注入漏洞

jfinal cms is a java development of powerful information consulting website , using a simple and powerful JFinal as the web framework , the template engine with beetl , database with mysql , front-end bootstrap framework . jfinal cms 5.1.0 version of a security vulnerability , the vulnerability...

UBUNTU-CVE-2022-25972

An out-of-bounds write vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2022-2198

The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displaying private messages, allowing any logged in user to read other users private message using the message id, which can easily be brute forced...

WordPress plugin WPQA Builder 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

MingSoft MCMS SQL注入漏洞

MingSoft MCMS is a complete open source J2ee system from China's MingSoft. A SQL injection vulnerability exists in MingSoft MCMS version 5.2.8, which originates from a SQL injection vulnerability in the /mdiy/model/delete URI containing a SQL injection via models Lists...

MingSoft MCMS SQL注入漏洞

MingSoft MCMS is a complete open source J2ee system from China's MingSoft. A SQL injection vulnerability exists in MingSoft MCMS version 5.2.8, which originates from an attacker being able to exploit the fieldName parameter of its /mdiy/page/verify URI component to achieve SQL injection...

DEBIAN-CVE-2022-35948

undici is an HTTP/1.1 client, written from scratch for Node.js.= [email protected] users are vulnerable to CRLF Injection on headers when using unsanitized input as request headers, more specifically, inside the content-type header. Example: import request from 'undici' const unsanitizedContentTypeInp...

Nordic Semiconductor nRF5 SDK 缓冲区错误漏洞

The Nordic Semiconductor nRF5 SDK is a software development kit from Nordic Semiconductor, Norway. It provides a rich development environment for the nRF51 and nRF52 family of SoCs. A security vulnerability exists in Nordic Semiconductor nRF5 SDK version 5.0, which is caused by a heap overflow...

Eyes of Network Web 跨站请求伪造漏洞

Eyes of Network Web is a global regulatory solution for hardware status of devices, operating systems, standard applications, business applications and performance from the Eyes of Network Web community. A security vulnerability exists in Eyes of Network Web version 5.3, which stems from a lack o...

CVE-2022-35587

A cross-site scripting XSS issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publishondate" Parameter...

Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad version 5.2.0, which stems from a flaw in its login credentials brute force feature that causes an attacker to bypass the feature's limitations before attempting a certain...