GHSA-3PGJ-PG6C-R5P7 OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI

Impact - Attacker providing malicious redirect uri can cause DoS to oauthlib's web application. - Attacker can also leverage usage of urivalidate functions depending where it is used. What kind of vulnerability is it? Who is impacted? Oauthlib applications using OAuth2.0 provider support or use...

PT-2022-33653 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.66 Description: The issue is related to the wifi mac80211 in IBSS mode. It was introduced in version v3.13 and fixed in Linux Kernel version v5.15.66. The actual impact and attack plausibility have not yet...

PT-2022-24070 · Phicomm · Phicomm Fir151B A2 +3

Name of the Vulnerable Software and Affected Versions: Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers version 3.0.1.17 Description: The issue is related to a remote command execution vulnerability. This vulnerability can be exploited via the pingAddr parameter of the tracert...

CVE-2022-38176

An issue was discovered in YSoft SAFEQ 6 before 6.0.72. Incorrect privileges were configured as part of the installer package for the Client V3 services, allowing for local user privilege escalation by overwriting the executable file via an alternative data stream. NOTE: this is not the same as...

YSoft SAFEQ 6 安全漏洞

YSoft SAFEQ 6 is an Enterprise Print Management Suite solution platform from YSoft Czech Republic. A security vulnerability exists in YSoft SAFEQ 6 versions prior to 6.0.72, which stems from incorrect permissions being configured as part of the installer package for the Client V3 service, and can...

PT-2022-24258 · Ysoft · Y Soft Safeq

Name of the Vulnerable Software and Affected Versions: YSoft SAFEQ versions prior to 6.0.72 Description: An issue in YSoft SAFEQ allows for local user privilege escalation. This is due to incorrect privileges configured as part of the installer package for the Client V3 services, enabling an...

CVE-2019-15167

The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrpprint for VRRP version 3, a different vulnerability than CVE-2018-14463...

CVE-2022-20823

A vulnerability in the OSPF version 3 OSPFv3 feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to incomplete input validation of specific OSPFv3 packets. An attacker could...

PT-2022-9905

Name of the Vulnerable Software and Affected Versions Python versions 3.x through 3.10 Description The issue is related to an open redirection vulnerability in lib/http/server.py due to no protection against multiple / at the beginning of URI path, which may lead to information disclosure. It is...

CandidATS SQL注入漏洞

CandidATS is a free and open source recruiter tracking system from CandidATS India. A security vulnerability exists in CandidATS version 3.0.0 Beta that stems from allowing authenticated users to inject SQL queries via the userID parameter...

UPX 数字错误漏洞

UPX is a portable and extensible executable compression program. A security vulnerability exists in UPX version 3.96, which stems from a floating-point exception issue found in the PackLinuxElf64::invertptdynamic function of the plxelf.cpp file, which can be triggered by an attacker with a crafte...

CVE-2022-36308

Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials unhashed on the filesystem, enabling anyone with web access to use these credentials to manipulate the eNodeB over SNMP. This issue may...

PT-2022-23303 · Airspan · Airspan Airvelocity 1500

Name of the Vulnerable Software and Affected Versions: Airspan AirVelocity 1500 versions prior to 15.18.00.2511 Description: The web management UI of the affected software displays SNMP credentials in plaintext and stores SNMPv3 credentials unhashed on the filesystem. This allows anyone with web...

PT-2022-22146 · Wms · Wms

Name of the Vulnerable Software and Affected Versions: WMS version 3.7 Description: The issue allows an attacker to potentially exploit a Path Traversal Vulnerability in the Device API, gaining unauthorized read access to files stored on the server filesystem with the privileges of the running we...

CVE-2022-35493

A Cross-site scripting XSS vulnerability in json search parse and the json response in wrteam.in, eShop - Multipurpose Ecommerce Store Website version 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the getproducts?search parameter...

rsync 输入验证错误漏洞

rsync is an open source utility program by Wayne Davison, an individual developer, that provides fast incremental file transfers. A security vulnerability exists in versions prior to rsync 3.2.5 that stems from insufficient validation of filenames by the rsync client...

CVE-2022-35118

PyroCMS v3.9 was discovered to contain multiple cross-site scripting XSS vulnerabilities...

PyroCMS 跨站脚本漏洞

PyroCMS is a lightweight open source content management system developed by an individual developer using the CodeIgniter framework. A cross-site scripting vulnerability exists in PyroCMS v3.9, which stems from being found to contain multiple cross-site scripting XSS vulnerabilities...

EllieGrid Android Application 代码注入漏洞

EllieGrid Android Application is a smart pill manager from US-based EllieGrid. A security vulnerability exists in EllieGrid Android Application version 3.4.1 that stems from vulnerability to code injection attacks...

"Hulu" App for Android uses a hard-coded API key for an external service

Overview "Hulu" App for Android provided by HJ Holdings, Inc. uses a hard-coded API key for an external service CWE-798. Ryo Sato of BroadBand Security, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact T...