CVE-2022-30237

A CWE-311: Missing Encryption of Sensitive Data vulnerability exists that could allow authentication credentials to be recovered when an attacker breaks the encoding. Affected Products: Wiser Smart, EER21000 & EER21001 V4.5 and prior...

CVE-2022-30524

There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mishandles characters at large y coordinates. It can be triggered by for example sending a crafted pdf file to the pdftotext binary, which allows a remote attacker to cause a Denia...

CVE-2021-39023

IBM Guardium Data Encryption GDE 4.0.0 and 5.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 213860...

CVE-2021-39027

IBM Guardium Data Encryption GDE 4.0.0 and 5.0.0 prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. IBM X-Force ID: 213865...

Contao 跨站脚本漏洞

Contao is an open source content management system CMS developed using PHP. The system supports search engines, rights management and CSS frameworks. A security vulnerability exists in Contao versions 4.13.0 through 4.13.3 and earlier, which allows untrusted users to inject malicious code into...

CVE-2022-28055

Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function...

PT-2022-19055 · Tcpreplay +4 · Tcpreplay +4

Name of the Vulnerable Software and Affected Versions: Tcpreplay version 4.4.1 Description: The issue is a memory leakage flaw in the fix ipv6 checksums function. This flaw poses the highest threat to data confidentiality. Recommendations: For Tcpreplay version 4.4.1, consider disabling the fix...

UBUNTU-CVE-2022-1475

An integer overflow vulnerability was found in FFmpeg versions before 4.4.2 and before 5.0.1 in g729parse in llibavcodec/g729parser.c when processing a specially crafted file...

SUSE-SU-2022:0845-2 Security update for chrony

This update for chrony fixes the following issues: Chrony was updated to 4.1, bringing features and bugfixes. Update to 4.1 Add support for NTS servers specified by IP address matching Subject Alternative Name in server certificate Add source-specific configuration of trusted certificates Allow...

PYSEC-2022-43167

Selenium Server Grid before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain...

CVE-2022-27368

Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component danceLists.phpzhuan...

CScms SQL注入漏洞

CScms is a content management system CMS developed based on the CI framework.Cscms Music Portal System v4.2 is vulnerable to SQL injection, which can be exploited by attackers to conduct injection attacks via the component danceDance.phphy...

CScms SQL注入漏洞

CScms is a content management system CMS developed based on the CI framework. cscms Music Portal System v4.2 is vulnerable to SQL injection, which can be exploited by attackers via the component danceLists.phpzhuan...

PT-2022-4846 · D Link · D-Link Dir-2150

Name of the Vulnerable Software and Affected Versions: D-Link DIR-2150 version 4.0.1 Description: This issue allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 routers. Authentication is not required to exploit this issue. The specific fla...

CVE-2022-1330

stored xss due to unsantized anchor url in GitHub repository alvarotrigo/fullpage.js prior to 4.0.4. stored xss...

CVE-2022-27416

Tcpreplay v4.4.1 was discovered to contain a double-free via interceptorfree...

PT-2022-18244 · Ghost · Ghost

Name of the Vulnerable Software and Affected Versions: Ghost version 4.39.0 Description: The issue concerns an arbitrary file upload vulnerability in the file upload module, potentially allowing attackers to execute arbitrary code via a crafted SVG file. However, the vendor states that uploading...

fullpage.js 跨站脚本漏洞

fullpage.js is an easy-to-use library for creating full-screen scrolling websites also known as single-page websites or mono-page websites and adding horizontal sliders to various parts of the website. A cross-site scripting vulnerability exists in fullpage.js prior to 4.0.4. No information about...

CVE-2021-36893

Authenticated author or higher user role Stored Cross-Site Scripting XSS vulnerability in Responsive Tabs WordPress plugin = 4.0.5...

WordPress plugin WP-Appbox 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in WordPress...