KINGSOFT Installer of WPS Office 代码问题漏洞

KINGSOFT Installer of WPS Office is an installer and setup program for WPS Office from the Chinese company KINGSOFT. A code issue vulnerability exists in KINGSOFT Installer of WPS Office versions 10.8.0.5745 through 10.8.0.6186, which stems from the application loading DLL libraries in an insecur...

CVE-2021-39051

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by improper input of application server registration function. A remote attacker could exploit this vulnerability using the host address and port fields of the application server...

UBUNTU-CVE-2021-44964

Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.05.4.3 allows attackers to perform Sandbox Escape via a crafted script file...

CVE-2021-39055

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2022-24397

SAP NetWeaver Enterprise Portal - versions 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting XSS vulnerability.This reflected cross-site scripting attack can be used to non-permanently deface or modify displayed content of...

Acer Care Center 授权问题漏洞

Acer Care Center is a system care center from Acer China Acer that allows you to back up or restore your system settings and network drivers to prevent the effects of system failure. Acer Care Center version 4.00.30xx to versions prior to 4.00.3042 A security vulnerability exists that originates...

CVE-2022-0507 Vulnerability: Authenticated SQL Injection in API

Found a potential security vulnerability inside the Pandora API. Affected Pandora FMS version range: all versions of NG version, up to OUM 759. This vulnerability could allow an attacker with authenticated IP to inject SQL...

CVE-2022-21828

A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unspecified attack vector in Incapptic Connect version 1.40.0, 1.39.1, 1.39.0, 1.38.1, 1.38.0, 1.37.1, 1.37.0, 1.36.0, 1.35.5, 1.35.4 and 1.35.3...

PT-2022-15974 · Cedar Gate · Cedar Gate Ez-Net Portal

Name of the Vulnerable Software and Affected Versions: Cedar Gate EZ-NET portal versions 6.5.5 through 6.8.0 Description: The issue arises from a call to display messages to users that does not properly sanitize data sent through a URL parameter, leading to a Reflected Cross-Site Scripting...

PT-2022-16218 · Elastic · Elasticsearch

Name of the Vulnerable Software and Affected Versions: Elasticsearch versions 7.16 through 7.17.0 Description: A flaw was discovered in Elasticsearch's upgrade assistant, which occurs when upgrading from version 6.x to 7.x, disabling the in-built protections on the security index. This allows...

PT-2022-10707 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.3.2 through 7.3.6 Liferay DXP 7.3 before fix pack 2 Description: A cross-site scripting XSS issue exists in the Blogs module's edit blog entry page, allowing remote attackers to inject arbitrary web script or HTML vi...

ai.grakn:grakn-test (>=0.13.0 <=0.15.0), ai.grakn:test-integration (=v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744) +838 more potentially affected by CVE-2022-24615 via net.lingala.zip4j:zip4j (>=1.2.3 <=2.0.2)

net.lingala.zip4j:zip4j MAVEN version =1.2.3, =0.13.0, =1.5.0, =1.0.0, =1.0.1, =1.0.4, =2.5.7, =1.1.13, =1.0.7, =1.1.4, =2.1.0, =1.0.0, =3.0.2, =1.0.3, =3.3.0, =3.3.9 and more Source cves: CVE-2022-24615 Source advisory: OSV:GHSA-Q62H-JW38-24VH...

fr.jetoile.hadoop:hadoop-unit-client-alluxio (>=2.2 <=3.8), io.minio:spark-benchmarks-dfsio_2.11 (=0.2.0) +57 more potentially affected by CVE-2022-23848 via org.alluxio:alluxio-core-common (>=1.0.0 <=2.7.2)

org.alluxio:alluxio-core-common MAVEN version =1.0.0, =2.2, =1.0.0, =1.5.0, =1.8.2, =1.1.0, =1.5.0, =1.5.0, =1.0.0, =1.5.0, =1.0.0, =1.5.0, =1.8.2, =1.8.2, =295 and more Source cves: CVE-2022-23848 Source advisory: OSV:GHSA-J3CH-VJPH-8Q6V...

CVE-2022-23053

Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Condition Widget” element, that allows the injection of malicious JavaScript into the ‘URL’ field. This issue affects: nasa openmct 1.7.7 version and prior versions; 1.3.0 version and later versions...

DEBIAN-CVE-2022-23647

Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text being inserted int...

@kamilic-pkg/toolbox (>=1.0.0 <=1.1.0), @q7/cli (>=0.0.2 <=0.2.0) +8 more potentially affected by CVE-2022-0748 via post-loader (>=1.1.2 <=2.0.0)

post-loader NPM version =1.1.2, =1.0.0, =0.0.2, =0.0.2, =0.1.0, =0.0.4, =0.0.1, =2.6.21, =0.0.2, =0.0.4 Source cves: CVE-2022-0748 Source advisory: SNYK:JS-POSTLOADER-2403737...

Qt 安全漏洞

Qt is a cross-platform C++ application development framework from the Norwegian company Qt. It is widely used to develop GUI programs, in which case it is also known as the widget toolkit. It can also be used to develop non-GUI programs, such as console tools and servers. A security vulnerability...

Vmware Cloud Foundation 资源管理错误漏洞

Vmware VMware Cloud Foundation is an all-in-one hybrid cloud platform from Vmware. The platform includes features such as operations automation, infrastructure auto-configuration, and integrated lifecycle management. A resource management error vulnerability exists in Vmware Cloud Foundation, whi...

PT-2022-12329 · Sqlite3 +1 · Sqlite3 +1

Name of the Vulnerable Software and Affected Versions: SQLite3 versions 3.35.1 through 3.37.0 Description: A Memory Leak issue exists in SQLite Project via maliciously crafted SQL Queries, made by editing the Database File. It is possible to query a record and leak subsequent bytes of memory that...

com.ericsson.bss.cassandra.ecaudit:ecaudit_c4.0 (=3.1.3), com.instaclustr:cassandra-lucene-index-plugin (=4.0.0-1.0.0) +18 more potentially affected by CVE-2021-44521 via org.apache.cassandra:cassandra-all (>=4.0.0 <=4.0.19)

org.apache.cassandra:cassandra-all MAVEN version =4.0.0, =4.4.0.0, =4.4.0.0, =1.0.31, =1.0.31, =1.0.86, =4.0.18.0, =4.0.18.0, =1.2.0, =1.5.0, =1.7.0 and more Source cves: CVE-2021-44521 Source advisory: OSV:GHSA-8FFC-79XG-29W8...