UBUNTU-CVE-2022-1100

A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 13.1 prior to 14.7.7, 14.8.0 prior to 14.8.5, and 14.9.0 prior to 14.9.2. The api to update an asset as a link from a release had a regex check which caused exponential number of backtracks for certain user...

2vyper (=0.3.0), ape-vyper (>=0.7.1 <=0.8.3) +23 more potentially affected by CVE-2022-24787 via vyper (>=0.1.0b12 <=0.3.10)

vyper PYPI version =0.1.0b12, =0.7.1, =0.1.0, =0.0.0, =0.0.0, =0.0.5, =0.1.0, =0.1.0, =0.1.10.0, =1.0.1, =0.1.0, =1.4.0, =0.2.1, =0.1.3, =0.1.10 and more Source cves: CVE-2022-24787 Source advisory: OSV:PYSEC-2022-196...

@cao_steven/nb-core (=1.0.0), @dcodegroup-au/dsg-vue (>=0.0.17 <=0.0.18) +85 more potentially affected by CVE-2022-0350 via vditor (>=2.3.1 <=3.3.9)

vditor NPM version =2.3.1, =0.0.17, =2.1.5, =2.1.5, =2.1.5, =2.1.5, =2.1.5, =2.1.5, =2.1.5, =0.0.1, =0.0.2, =0.0.1-beta.15, =0.0.1, =0.0.0, =0.0.24 and more Source cves: CVE-2022-0350 Source advisory: OSV:GHSA-689X-X68P-FPH3...

GitLab Enterprise Edition 跨站脚本漏洞

GitLab Enterprise Edition is a content management system. A cross-site scripting vulnerability exists in GitLab Enterprise Edition versions 14.4.0 through 14.9.1 that stems from insufficient cleanup of user-supplied data in comments. A remote user can exploit this vulnerability to inject and...

PT-2022-6720 · Adobe · Acrobat Reader

Name of the Vulnerable Software and Affected Versions: Acrobat Reader DC versions 17.012.30205 through 22.001.20085 Acrobat Reader DC versions 20.005.3031x and earlier Description: The issue is related to an out-of-bounds write vulnerability that could result in arbitrary code execution in the...

PT-2022-13134 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.4 through 14.7.1 Description: The issue is related to improper access control, allowing project non-members to retrieve the service desk email address. Recommendations: For GitLab CE/EE versions 12.4 through 14.7.1,...

3deecelltracker (=1.0.0), abracadabra (>=0.0.0 <=0.0.7) +92 more potentially affected by CVE-2022-24758 via notebook (>=4.2.3 <=6.4.1)

notebook PYPI version =4.2.3, =0.0.0, =1.0.0, =1.0.0, =0.1.1, =1.0.1, =1.0.0, =0.3.4, =0.1.0rc1, =0.0.1, =0.1.3, =0.2.4 and more Source cves: CVE-2022-24758 Source advisory: OSV:PYSEC-2022-180...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2 <=4.6.0.0), ai.ylyue:yue-library-auth-client (=j11.2.6.0) +2346 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (>=2.6.0 <=2.6.5)

org.springframework.boot:spring-boot-starter-web MAVEN version =2.6.0, =4.4.0.2, =j11.2.6.0, =1.2.5.RELEASE, =0.1.2, =5.7.7, =5.7.7, =5.7.7, =1.0.0, =1.0.2, =1.0.0, =3.1.305, =3.1.305, =3.1.313 and more Source cves: CVE-2022-22965 Source advisory: OSV:GHSA-36P3-WJMG-H94X...

elita (>=0.60.0 <=0.64.1), slskit (>=2020.1.1 <=2020.9.0) potentially affected by CVE-2022-22934 via salt (>=2014.1.10 <=3001.8.0)

salt PYPI version =2014.1.10, =0.60.0, =2020.1.1, =2020.9.0 Source cves: CVE-2022-22934 Source advisory: OSV:GHSA-2Q4G-WFM6-5FPM...

CVE-2022-27888

Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information session tokens. This issue was fixed in 2.249.1...

UBUNTU-CVE-2021-4191

An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Private GitLab instances with restricted sign-ups may be vulnerable to user enumeration to unauthenticated users through the GraphQL API...

Deno 安全漏洞

Deno is open source a simple , modern and secure JavaScript and TypeScript runtime environment . It uses V8 and built with Rust. Versions of Deno from 1.18.0 to 1.20.2 contain a security vulnerability that allows an attacker to bypass all privilege checks and execute arbitrary shell code...

depend (>=0.2.0 <=0.3.0), ekrhizoc (>=0.0.5 <=0.1.0) +12 more potentially affected by CVE-2022-26184 via poetry (>=1.0.0 <=1.1.5)

poetry PYPI version =1.0.0, =0.2.0, =0.0.5, =2020.1.0, =0.1.4, =5.2.0, =0.0.5, =0.1.0, =0.4.0, =0.1.0, =0.3.0, =0.1.3, =0.0.1, =0.1.4 Source cves: CVE-2022-26184 Source advisory: OSV:GHSA-XR2C-5W89-63PV...

CVE-2022-25518

In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to read the password of the users who login to the application by querying the database table...

CMDBuild 日志信息泄露漏洞

CMDBuild is an open source web enterprise environment for configuring custom applications for asset management. A security vulnerability exists in CMDBuild versions 3.0 through 3.3.2, which stems from the fact that payload requests for CMDBuild versions 3.0 through 3.3.2 are stored in a temporary...

-tompan-reacttemplate (>=1.0.1 <=1.1.0), 00ld8nuivn (=2.1.0) +40718 more potentially affected by CVE-2022-24771 via node-forge (>=0.10.0 <=1.2.1)

node-forge NPM version =0.10.0, =1.0.1, =1.1.0 - 00ld8nuivn =2.1.0 - 00rqiw31nd =2.1.0 - 01dk01majk =2.1.0 - 02rjq8i863 =1.1.0 - 02vx8qsp01 =2.1.0 - 05y6tjgmws =1.1.0 - 066m7q8o0z =2.1.0 - 06buj9h3su =2.1.0 - 06dre15t8r =2.1.0 - 0726react =0.1.1 - 07fgapmu9l =1.1.0 - 07t2xvu6t4 =2.1.0 - 0850u4lkp...

PT-2022-16745 · Unknown · Automotive Grade Linux

Name of the Vulnerable Software and Affected Versions: Automotive Grade Linux Kooky Koi versions 11.0.0 through 11.0.5 Description: The issue is related to Incorrect Access Control in usr/bin/afb-daemon. To exploit this, an attacker needs to send a well-crafted HTTP or WebSocket request to the...

Automotive Grade Linux Kooky Koi 安全漏洞

Automotive Grade Linux Kooky Koi is a Linux Foundation in-vehicle system. A security vulnerability exists in Automotive Grade Linux Kooky Koi versions 11.0.0 through 11.0.5, which stems from incorrect access control in usr/bin/afb-daemon. An attacker can exploit the vulnerability by sending a...

cradle-app (>=0.1.0 <=0.1.1), torchflare (=0.2.4) potentially affected by CVE-2022-24770 via gradio (>=1.7.7 <=2.2.13)

gradio PYPI version =1.7.7, =0.1.0, =0.1.1 - torchflare =0.2.4 Source cves: CVE-2022-24770 Source advisory: OSV:PYSEC-2022-229...

KINGSOFT Installer of WPS Office 代码问题漏洞

KINGSOFT Installer of WPS Office is an installer and setup program for WPS Office from the Chinese company KINGSOFT. A code issue vulnerability exists in KINGSOFT Installer of WPS Office versions 10.8.0.5745 through 10.8.0.6186, which stems from the application loading DLL libraries in an insecur...