4936 matches found
aiohttp-init (=0.0.1), airhttprunner (>=3.1.4 <=3.1.6) +152 more potentially affected by CVE-2022-0338 via loguru (>=0.2.4 <=0.5.2)
loguru PYPI version =0.2.4, =3.1.4, =0.1.5, =0.1.1, =2.0.0, =0.2.3, =4.6.4, =2.3.2, =0.39.0, =0.52.0 and more Source cves: CVE-2022-0338 Source advisory: OSV:PYSEC-2022-14...
PT-2022-6698 · Moodle +2 · Moodle +2
Name of the Vulnerable Software and Affected Versions: Moodle versions 3.11 to 3.11.4 Description: A flaw was found in the h5p activity web service of Moodle, which is responsible for fetching user attempt data. This flaw is related to insufficient protection of the SQL query structure, allowing...
Land Software Faust Iserver 路径遍历漏洞
Land Software Faust Iserver is used by Land Software Germany to bring Faust, Faust Entry and Lidos databases to the Intranet and Internet. A path traversal vulnerability exists in Land Software FAUST iServer versions 9.0.017.017.1- 9.0.018.018.4, which stems from a lack of local include...
GHSA-QRPM-P2H7-HRV2 Exposure of Sensitive Information to an Unauthorized Actor in nanoid
The package nanoid from 3.0.0, before 3.1.31, are vulnerable to Information Exposure via the valueOf function which allows to reproduce the last id generated...
ae.teletronics.nlp:entityextraction (>=1.3 <=1.4), ai.tock:tock-nlp-model-stanford (>=19.9.0 <=22.3.2) +202 more potentially affected by CVE-2022-0239 via edu.stanford.nlp:stanford-corenlp (>=1.2.0 <=4.3.2)
edu.stanford.nlp:stanford-corenlp MAVEN version =1.2.0, =1.3, =19.9.0, =2.09, =2.7.3, =2.7.3, =2.7.3, =2.0.0, =2.0.1, =2.5, =3.0.1 - com.github.hungntbka:htime =1.0 - com.github.jenshaase.uimascala:arktweetpostagger2.11 =0.6.1 - com.github.jenshaase.uimascala:arktweettokenizer2.11 =0.6.1 -...
aiida-core (=1.0.0), alerce (>=0.2.2 <=0.2.4) +38 more potentially affected by CVE-2022-21699 via ipython (>=4.1.1 <=6.0.0)
ipython PYPI version =4.1.1, =0.2.2, =0.3.5, =2.0.3, =1.15.2, =2.0.0, =0.2.0, =2.0.0, =0.8.2, =1.0.0b1, =1.1.3.0, =1.0.0.post2, =0.0.7, =0.3.2 and more Source cves: CVE-2022-21699 Source advisory: OSV:PYSEC-2022-12...
CVE-2022-21359
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Optimization Framework. Supported versions that are affected are 8.57, 8.58 and 8.59. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSo...
UBUNTU-CVE-2022-0093
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab allows a user with an expired password to access sensitive information through RSS feeds...
PT-2022-12979 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions 12.0 through 14.4.5 GitLab versions 14.5.0 through 14.5.3 GitLab versions 14.6.0 through 14.6.2 Description: An issue has been discovered in GitLab where it was not verifying that a maintainer of a project had the right access...
org.jenkins-ci.plugins:bitbucket-approval-filter (=1.0.0), org.jenkins-ci.plugins:bitbucket-filter-project-trait (=1.0) +1 more potentially affected by CVE-2022-20618 via org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (>=2.2.0 <=2.4.1)
org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source MAVEN version =2.2.0, =1.0.0, =1.0.2 Source cves: CVE-2022-20618 Source advisory: OSV:GHSA-W2MH-6XJ5-F77F...
cc.jweb:jweb-adai (>=1.0.2 <=1.0.6), cc.jweb:jweb-boot (>=1.0.2 <=1.0.5) +74 more potentially affected by CVE-2021-43297 via org.apache.dubbo:dubbo (>=2.7.0 <=2.7.14)
org.apache.dubbo:dubbo MAVEN version =2.7.0, =1.0.2, =1.0.2, =1.2.1, =1.28.0, =2.0.0.RELEASE, =2.0.0.RELEASE, =2.0.0.RELEASE, =2.0.0.RELEASE, =2.0.0.RELEASE, =0.0.1, =1.0.3, =1.0.3, =1.5.1, =2.0.1, =2.0.11 and more Source cves: CVE-2021-43297 Source advisory: OSV:GHSA-VP5X-3V8R-QPRW...
admin-tool-button (>=1.0.1a0 <=1.0.5a0), apis-ampel (=0.1.0) +51 more potentially affected by CVE-2021-45115 via django (>=3.2.0 <=3.2.10)
django PYPI version =3.2.0, =1.0.1a0, =0.2.0, =22.0.0.dev21, =22.0.0.dev13, =22.0.0.dev29, =22.0.0.dev30 - autoreduce-utils =0.1.0 - common-framework =2021.4.1 - directory-validators =9.0.0 - django-admin-taggit-ui =0.1.0.dev0 - django-blocklist =1.0.0 - django-brazilian-zipcode =0.1.0 -...
CVE-2022-22121
In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability Formula Injection. A low privileged attacker can create a new table to inject payloads in the table rows. When an administrator accesses the User Management endpoint and exports the data as a CSV file and opens...
cn.ac.ios.tis:riscvspeccore_2.12 (>=0.1.0 <=1.0.0), cn.dustlight.flow:flow-zeebe (>=0.1.3-alpha <=0.1.7-alpha) +1037 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (>=3.18.0 <=3.18.1)
com.google.protobuf:protobuf-java MAVEN version =3.18.0, =0.1.0, =0.1.3-alpha, =0.0.1-alpha, =0.0.2-alpha - cn.vertxup:vertx-co =0.7.0 - cn.vertxup:vertx-ifx =0.7.0 - cn.vertxup:vertx-import =0.7.0 - cn.vertxup:vertx-pin =0.7.0 - cn.vertxup:vertx-rx =0.7.0 - cn.vertxup:vertx-tp =0.7.0 -...
ae.teletronics.nlp:entityextraction (=1.3), ae.teletronics.nlp:w2vec (=1.0) +20429 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (>=2.0.3 <=3.16.0)
com.google.protobuf:protobuf-java MAVEN version =2.0.3, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.10 and more Source cves: CVE-2021-22569 Source advisory: OSV:GHSA-WRVW-HG22-4M67...
@esfaenza/core (>=15.2.16 <=19.2.114), @naxxfish/whereis (=0.0.1) +15 more potentially affected by CVE-2021-43862 via jquery.terminal (>=0.10.12 <=2.23.2)
jquery.terminal NPM version =0.10.12, =15.2.16, =0.0.1, =0.1.3, =2.0.0, =3.3.2, =0.0.3, =1.0.4, =0.1.0, =1.0.0, =1.0.2, =0.0.1, =0.0.10 and more Source cves: CVE-2021-43862 Source advisory: OSV:GHSA-X9R5-JXVQ-4387...
Additional Log Injection in Spring Framework (follow-up to CVE-2021-22096)
In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more...
CVE-2022-22116
In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting XSS vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victim’s browser when they open the image...
PT-2022-11334 · Unknown +1 · Checkmk Raw Edition +1
Name of the Vulnerable Software and Affected Versions: CheckMK Raw Edition software versions 1.5.0 through 1.6.0 Description: The issue allows for Reflected XSS, enabling an attacker to inject malicious HTML content, including JavaScript or other client-side scripts, into a user's browser. This...