CVE-2022-43120

A cross-site scripting XSS vulnerability in the /panel/fields/add component of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field default value text field...

kernel: NFSv4: Fix free of uninitialized nfs4_label on referral lookup.

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix free of uninitialized nfs4label on referral lookup. Send along the already-allocated fattr along with nfs4fslocations, and drop the memcpy of fattr. We end up growing two more allocations, but this fixes up a crash as:...

Symantec Endpoint Detection And Response 安全漏洞

Broadcom Symantec Endpoint Detection And Response is an endpoint security detection and response solution from Broadcom. A security vulnerability exists in the Symantec Endpoint Detection And Response SEDR Appliance prior to version 4.7.0, which stems from susceptibility to elevation of privilege...

PT-2022-25292 · Searchwp · Searchwp

Name of the Vulnerable Software and Affected Versions: SearchWP premium plugin versions = 4.2.5 Description: The issue concerns nonce token leakage and missing authorization in the SearchWP premium plugin, allowing unauthorized changes to plugin settings. Recommendations: For SearchWP premium...

s::can moni::tools 路径遍历漏洞

s::can moni::tools is a platform from s::can for managing a virtually unlimited number of sites, online probes, analyzers, and parameters. A path traversal vulnerability exists in s::can moni::tools version 4.2 and earlier. An attacker can exploit this vulnerability to obtain any file...

PT-2022-27025 · Suse · Suse Linux Enterprise Module For Suse Manager Server 4.2 +3

Name of the Vulnerable Software and Affected Versions: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 versions prior to 4.2.28 SUSE Linux Enterprise Module for SUSE Manager Server 4.3 spacewalk-java versions prior to 4.3.39 SUSE Manager Server 4.2 release-notes-susemanager versions prio...

ETIC Telecom Remote Access Server 数据伪造问题漏洞

ETIC Telecom Remote Access Server is a remote maintenance solution from the French company ETIC Telecom. It is designed to enable manufacturers to maintain automated equipment remotely. A data forgery vulnerability exists in ETIC Telecom Remote Access Server RAS version 4.5.0 and prior versions,...

CVE-2021-35388

Hospital Management System v 4.0 is vulnerable to Cross Site Scripting XSS via /hospital/hms/admin/patient-search.php...

CVE-2022-33859

A security vulnerability was discovered in the Eaton Foreseer EPMS software. Foreseer EPMS connects an operation’s vast array of devices to assist in the reduction of energy consumption and avoid unplanned downtime caused by the failures of critical systems. A threat actor may upload arbitrary...

AZL-11283 CVE-2022-3570 affecting package libtiff for versions less than 4.4.0-5

Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact...

LibTIFF 缓冲区错误漏洞

LibTIFF is a library for reading and writing TIFF Tagged Image File Format files. The library contains a number of command-line tools for handling TIFF files.LibTIFF version 4.4.0 is vulnerable to a buffer overflow vulnerability, which stems from the existence of multiple heap buffer overflows th...

kernel: information leak in the IPv4 implementation

An information leak flaw was found in the Linux kernel’s IPv4 implementation in the iprtinit in net/ipv4/route.c function. The use of a small hash table in IP ID generation allows a remote attacker to reveal sensitive information...

CVE-2022-41390

OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at download.php...

CVE-2022-41391

OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at showImg.php...

CVE-2022-39800

SAP BusinessObjects BI LaunchPad - versions 420, 430, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the user inputs while interacting on the network. On successful exploitation, an attacker can view or modify information causing a limited...

mxGraph 跨站脚本漏洞

mxGraph is a JavaScript charting library. A security vulnerability exists in mxGraph version v4.2.2, which stems from the discovery of a cross-site scripting XSS vulnerability contained via the setTooltips function...

UBUNTU-CVE-2022-2628

The DSGVO All in one for WP WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2022-34606 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v4.8 through v5.19.8 Description: A use-after-free issue was discovered. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions v4.8 through v5.19.8, update to...

CVE-2022-41844

An issue was discovered in Xpdf 4.04. There is a crash in XRef::fetchint, int, Object, int in xpdf/XRef.cc, a different vulnerability than CVE-2018-16369 and CVE-2019-16088...

XPDF 缓冲区错误漏洞

XPDF is an open source PDF reader. The product supports decoding files in LZW compressed format and reading encrypted PDF files. A resource management error vulnerability exists in XPDF version 4.04, which stems from a crash in the gfseek IOFILE, long, int function in goo/gfile.cc. No details of...