GitLab CE/EE 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A security vulnerability exists in GitLab CE/EE that stems from allowing projec...

CVE-2022-31775

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or...

mariadb: server crash in Item_func_in::cleanup/Item::cleanup_processor

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Itemfuncin::cleanup/Item::cleanupprocessor...

CVE-2022-36953

In Veritas NetBackup OpsCenter, certain endpoints could allow an unauthenticated remote attacker to gain sensitive information. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10...

PT-2022-23703 · Veritas · Netbackup

Name of the Vulnerable Software and Affected Versions: Veritas NetBackup versions 9.0.0.1 through 9.1.0.1 Description: The issue allows arbitrary command execution from any remote host that has access to a valid host-id NetBackup certificate/private key from the same domain. Recommendations: For...

4337-snap (>=0.1.0, <=0.1.1), @0xabcdefg/smart-order-router (>=1.0.0, <=1.0.5) +1211 more potentially affected by CVE-2022-31170 via @openzeppelin/contracts (>=4.0.0, <=4.7.0)

@openzeppelin/contracts NPM version =4.0.0, =0.1.0, =1.0.0, =1.0.0, =3.24.7, =1.7.2, =1.0.0, =0.2.0, =1.0.2, =4.0.0-prerelease, =4.0.1-alpha, =2.0.0-beta.1, =2.0.3, =2.1.0 and more Source cves: CVE-2022-31170 Source advisory: OSV:GHSA-QH9X-GCFH-PCRW...

CVE-2022-21568

Vulnerability in the Oracle iReceivables product of Oracle E-Business Suite component: Access Request. Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iReceivables. Successfu...

CVE-2022-21429

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications component: Billing Care. Supported versions that are affected are 12.0.0.4.0-12.0.0.6.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access v...

Oracle Enterprise Manager Base Platform 输入验证错误漏洞

Oracle Enterprise Manager Base Platform is a set of local management platform of Oracle Oracle. The platform is primarily used to manage Oracle product deployments. An input validation error vulnerability exists in Oracle Enterprise Manager Base Platform component: Enterprise Manager Install...

PT-2022-3726

Name of the Vulnerable Software and Affected Versions Apache Spark versions 3.0.3 and earlier Apache Spark versions 3.1.1 to 3.1.2 Apache Spark versions 3.2.0 to 3.2.1 Description The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an...

CVE-2021-46784

In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses...

pyenv 路径遍历漏洞

pyenv is a simple Python versioning tool. A security vulnerability in pyenv versions 1.2.24 through 2.3.2 exists that allows local users to gain privileges through the .python-version file in the current working directory...

PT-2022-22974 · Pyenv · Pyenv

Name of the Vulnerable Software and Affected Versions: pyenv versions 1.2.24 through 2.3.2 Description: The issue allows local users to gain privileges via a .python-version file in the current working directory. An attacker can craft a Python version string in .python-version to execute shims...

Gollum 跨站脚本漏洞

Gollum is a simple wiki system built on top of Git by Gollum. It has a good API and a native front-end. A security vulnerability exists in Gollum versions 5.0 through 5.1.2, which originates from cross-site scripting XSS in gollum via filename arguments to the New Page dialog box...

PT-2022-15453 · Ibm · Ibm Websphere Application Server

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server versions 7.0 through 9.0 Description: The issue is caused by improper handling of Administrative Console data, allowing a remote attacker to obtain sensitive information. This information could be used in...

IBM Spectrum Protect Server 安全漏洞

IBM Spectrum Protect Server is a spectrum protection system from IBM USA. Provides total data resilience for physical file servers, virtual environments and a wide range of applications. A security vulnerability exists in IBM Spectrum Protect Server versions 8.1.0.000 through 8.1.14.000 that...

CVE-2021-41042

In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved...

IBM App Connect Enterprise 信任管理问题漏洞

IBM App Connect Enterprise is an operating system from IBM Corporation of the U.S.A. IBM App Connect Enterprise combines existing industry-trusted IBM Integration Bus technology with IBM App Connect Professional and new cloud-native technologies to IBM App Connect Enterprise combines existing...

CVE-2022-27627

Cross-site scripting vulnerability in Organization's Information of Cybozu Garoon 4.10.2 to 5.5.1 allows a remote attacker to execute an arbitrary script on the logged-in user's web browser...

CVE-2022-27627

Cross-site scripting vulnerability in Organization's Information of Cybozu Garoon 4.10.2 to 5.5.1 allows a remote attacker to execute an arbitrary script on the logged-in user's web browser...