3294 matches found
PT-2022-22865 · Zammad · Zammad
Name of the Vulnerable Software and Affected Versions: Zammad version 5.2.0 Description: The issue allows customers with secondary organizations assigned to view all organizations in the system, rather than only those they are assigned to. Recommendations: For Zammad version 5.2.0, at the moment,...
GHSA-763J-Q7WV-VF3M JSPUI's controlled vocabulary feature vulnerable to Open Redirect before v6.4 and v5.11
Impact The JSPUI controlled vocabulary servlet is vulnerable to an open redirect attack, where an attacker can craft a malicious URL that looks like a legitimate DSpace/repository URL. When that URL is clicked by the target, it redirects them to a site of the attacker's choice. This vulnerability...
CLSA-2022-1659636700 Fix CVE(s): CVE-2022-21515
SECURITY UPDATE: Update to 5.7.39 to fix security issues - CVE-2022-21515 - debian/patches/disabletests.patch: added new failing test with 5.7.39...
ITPison OMICARD EDM 路径遍历漏洞
ITPison OMICARD EDM is a high-speed email newsletter EDM marketing and distribution system from ITPison China. A security vulnerability exists in ITPison OMICARD EDM versions v5.8 to v6.0. The vulnerability stems from a path traversal in OMICARD EDM's Mail Image Forwarding feature, which can be...
CVE-2022-34928
JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via /system/user...
Trend Micro VPN Proxy Pro 安全漏洞
Trend Micro VPN Proxy Pro is one of the best virtual private network services from Trend Micro. A security vulnerability exists in Trend Micro VPN Proxy Pro version 5.2.1026 and prior versions. A local attacker could exploit the vulnerability to gain elevation of privilege on affected systems...
Desdev DedeCMS 安全漏洞
Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has content publishing, content management, content editing and content retrieval functions. A security vulnerability exists in...
DENSO WAVE QR Code Generator 路径遍历漏洞
DENSO WAVE QR Code Generator is a QR code generator from DENSO WAVE Japan. A security vulnerability exists in DENSO WAVE QR Code Generator version v5.2.7. An attacker can exploit the vulnerability to perform directory traversal...
WordPress plugin WP Visitor Statistics SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...
UBUNTU-CVE-2022-31151
Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There are active users using cookie headers in undici. This may lead to accidental leakage of cookie to a 3rd-party site or...
DEBIAN-CVE-2022-31150
undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate \r\n is a workaround for this...
CVE-2022-31201
SoftGuard Web SGW before 5.1.5 allows HTML injection...
Ambit Technologies iTech Freelancer Script SQL注入漏洞
Ambit Technologies iTech Freelancer Script is a popular and cost-effective solution from Ambit Technologies India for launching your freelancer website. Ambit Technologies Itech Freelancer Script version 5.13 suffers from a security vulnerability that stems from the presence of unknown...
PT-2022-20572 · Unknown · Lti 1.3 Tool Library
Name of the Vulnerable Software and Affected Versions: LTI 1.3 Tool Library versions prior to 5.0 Description: The issue concerns the function used to generate random nonces, which was not sufficiently cryptographically complex. This could make values predictable and tokens forgable. There are no...
UBUNTU-CVE-2022-25802
Best Practical Request Tracker RT before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment...
Mogu blog 跨站脚本漏洞
Mogu blog 蘑菇博客 is a micro-architecture based front-end and back-end shared blogging system by individual developers in Streamlet, China. A security vulnerability exists in Mogu blog version 5.2. The vulnerability stems from the fact that the format of user uploads is not strictly verified and is...
UBUNTU-CVE-2022-24808
net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can use a malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable to cause a NULL pointer dereference. Version 5.9.2 contains a patch. Users shou...
PT-2022-20050 · Opencti · Opencti
Name of the Vulnerable Software and Affected Versions: OpenCTI versions 5.2.4 and earlier Description: A broken access control issue has been identified in the profile endpoint. This allows an attacker to change their registered e-mail address and API key, despite this action not being possible...