UPX 安全漏洞

UPX is a portable and extensible executable compression program. A security vulnerability exists in UPX version 4.0.0, which originates from an attacker being able to cause invalid memory address references to the elflookup function of its plxelf.cpp component via a carefully crafted Mach-O file...

TOTOLINK A3600R 操作系统命令注入漏洞

The TOTOLINK A3600R is a 6-antenna 1200M wireless router from China's TOTOLINK. An operating system command injection vulnerability exists in the TOTOLINK A3600R version V4.1.2cu.5182B20201102, which stems from a command injection issue with the username parameter in the /cstecgi.cgi location...

CVE-2022-38078

Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Type XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products and...

CVE-2022-35150

Baijicms v4 was discovered to contain an arbitrary file upload vulnerability...

CVE-2022-35150

Baijicms v4 was discovered to contain an arbitrary file upload vulnerability...

WordPress plugin smartypants SP Project & Document Manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2022-36224

XunRuiCMS V4.5.6 is vulnerable to Cross Site Request Forgery CSRF...

XunRuiCMS 跨站请求伪造漏洞

XunRuiCloud Software Development XunRuiCMS XunRuiCMS is an open source content management system CMS from China's XunRuiCloud Software Development Company. A security vulnerability exists in XunRuiCMS version V4.5.6, which originates from the presence of cross-site request forgery CSRF...

Appneta Tcpreplay 缓冲区错误漏洞

Appneta Tcpreplay is a suite of open source utilities for editing and replaying network traffic on UNIX-based operating systems from Appneta, Inc. A security vulnerability exists in Tcpreplay version v4.4.1, which stems from a heap-based buffer overflow contained in parsempls in common/get.c:150 ...

kkFileView 跨站脚本漏洞

Keking kkFileView is a Spring-Boot project for online previewing of documents by Keking Technology Keking. A cross-site scripting vulnerability exists in kkFileView v4.1.0, which originates from multiple cross-site scripts in the urls and currentUrl parameters of the...

Apache OpenOffice 安全特征问题特征问题漏洞

Apache OpenOffice is an open source office software suite from the U.S. Apache Apache Foundation. The suite contains text documents, spreadsheets, presentations, drawings, databases and more. A security feature issue vulnerability exists in Apache OpenOffice versions prior to 4.1.13, which stems...

B&R Automation Studio 输入验证错误漏洞

B&R Automation Studio is an integrated software development environment from B&R Automation, an Austrian company. A security vulnerability exists in B&R Automation Studio versions above 4.0, which stems from an input validation vulnerability in the project upload mechanism that could allow an...

kernel: NFSv4: Fix free of uninitialized nfs4_label on referral lookup.

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix free of uninitialized nfs4label on referral lookup. Send along the already-allocated fattr along with nfs4fslocations, and drop the memcpy of fattr. We end up growing two more allocations, but this fixes up a crash as:...

CVE-2022-36831

Path traversal vulnerability in UriFileUtils of Samsung Notes prior to version 4.3.14.39 allows attacker to access some file as Samsung Notes permission...

BigTree CMS 跨站脚本漏洞

BigTree CMS is a content management system. A security vulnerability exists in BigTree CMS version 4.4.16, which stems from the inclusion of an arbitrary file upload issue that allows an attacker to execute arbitrary code via a crafted PDF file...

PT-2022-23021 · Openzeppelin · Openzeppelin Contracts

Name of the Vulnerable Software and Affected Versions: OpenZeppelin Contracts versions prior to 4.7.2 Description: The target contract of an EIP-165 supportsInterface query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a...

OpenZeppelin 安全漏洞

OpenZeppelin is a software application. A standard for secure blockchain applications. A security vulnerability exists in OpenZeppelin Contracts prior to version v4.7.2, which stems from the fact that this is a library for secure smart contract development, and that contracts using Arbitrum L2's...

WordPress plugin Featured Image from URL (FIFU) 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

GHSA-449W-C77C-VMF6 Lack of authentication mechanism in Jenkins Git Plugin webhook

Git Plugin provides a webhook endpoint at /git/notifyCommit that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Gi...

Jenkins Git Plugin 访问控制错误漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. An Access Control Error...